Real-time Practical Analysis of Data Decay in Physical Memory

Memory management in an operating system is the mechanism that governs the allocation, de-allocation, and organization of memory resources to maximize efficiency. In the Microsoft Windows operating system, the memory manager supports virtual memory and provides core services such as memory-mapped files, copy-on-write memory, large memory support, and underlying cache management. This paper details an initial study on real-time capture and measurement of data decay in physical memory on a system running Microsoft Windows 10. Unlike work focused on data recovery for forensic purposes, this research examines the longevity of data in physical memory, its rate of decay, the amount of data retrievable over time, and the factors influencing decay. Specifically, the study investigates the decay of data remaining in physical memory after a process has terminated. We developed and implemented a practical method for monitoring data decay at the page level in real-time. Experiments revealed that application data can persist and remain retrievable for up to 14 hours after the parent process terminates. Beyond recovery by entities with physical access or administrative privileges, previous vulnerabilities and exploits have shown the feasibility of data recovery by remote users with limited privileges, potentially exposing residual fragments similar to those identified in this study. This paper presents the methodology, test environment, custom tool-set, and initial findings, offering insights into the implications of data persistence in physical memory. The key contribution from this work is a practical real-time approach for monitoring the decay of data in physical memory and extraction of said data after a process has terminated demonstrating existing gaps in current security controls.