Someone's been at my computer, how do i find out for sure?

[tact]

If you have read the paper you'd have seen even in the abstract that "DRMS used in most modern computr retain their contents for seconds to minutes after power is lost".
Hence if you poweroff the computer a bit longer it is perfectly safe

A little impractical...
- how many minutes, after powering off your PC, before you are safe?
- most people do leave their PC turned on (perhaps locked) when they go make a coffee or take a toilet stop (at home or office). Most people don't shut down, wait 1?, 5?, 10? minutes for DRAM to die, then only go pee-pee and have to wait for their machine to reboot when they get back.
- most people don't know 10 minutes ahead of time when someone might snatch their laptop right from under their nose at Starbucks, and only those with good sources (not open sources) will ever know 10 minutes ahead of time when the FBI might break down their door.

But... as impractical as it may seem to always be prepared for every possibility your PC may be accessed by someone, and ensure that your PC/laptop has been turned off for at least 10-20 minutes beforehand - I agree with you that whole disk encryption does have its uses. (Like when the DRAM has been powered off for some time)

However... I would tend to steer away from giving assurances that encryption is THE answer to unauthorised access....

[hyper_ch]

A little impractical...

That's your opinion...

- how many minutes, after powering off your PC, before you are safe?

Have a look at the study

- most people do leave their PC turned on (perhaps locked) when they go make a coffee or take a toilet stop (at home or office). Most people don't shut down, wait 1?, 5?, 10? minutes for DRAM to die, then only go pee-pee and have to wait for their machine to reboot when they get back.

There are other options as well as shutting down... check the study

- most people don't know 10 minutes ahead of time when someone might snatch their laptop right from under their nose at Starbucks,

Why do you leave your notebook unattended?

and only those with good sources (not open sources) will ever know 10 minutes ahead of time when the FBI might break down their door.

The FBI does not concern me at all

But... as impractical as it may seem to always be prepared for every possibility your PC may be accessed by someone, and ensure that your PC/laptop has been turned off for at least 10-20 minutes beforehand - I agree with you that whole disk encryption does have its uses. (Like when the DRAM has been powered off for some time)

If you're that paranoid at the FBI catchin you then you should be prepared for every possibility

However... I would tend to steer away from giving assurances that encryption is THE answer to unauthorised access....

I'm open to other suggestions? Under normal circumstances encryption is THE answer to unauthorized access.

[smc18]

EDIT: WHOA!! Really old POST. I'm sorry.

Video Includes:

1- Running Windows XP
2- Plugged in external HDD with bootable tool installed
3- Removed Battery (Laptop shuts off)
4- Reinsert battery and boot off the external HDD.

My question is, that tool would only work if your BIOS boot order was set to boot to USB-HDD before internal HDD.

In the paper they also mentioned being able to boot from PXE, but still Network boot would still have to be above internal HDD in the boot order.

Excellent tool they made, I just thought I'd point out the above two complications.

So always leave your internal HDD #1 in your BIOS boot order

(On a side note: I wonder if the contents in the RAM would disappear before you could enter BIOS and edit the Boot order)

[lisati]

(On a side note: I wonder if the contents in the RAM would disappear before you could enter BIOS and edit the Boot order)

I've had the rare occasion on restarting when Ubuntu goes through its boot up, and a distorted version ot an XP splash screen shows momentarily just before the Ubuntu splash screen appears. Probably something to do with the screen mode changing before Ubuntu has had a chance to update the contents of video RAM. (I vaguely remember seeing a thread somewhere about this confusing a new user.)