What is a cold boot attack, and how to protect your computer

Full-disk encryption protects your data when a device is off. While it is on (or asleep), the key that unlocks everything has to be kept in the computer's memory (RAM) so it can read your files. Getting at that memory is called a memory attack; the best known is the cold boot attack.

How a cold boot attack works

Memory chips do not go blank instantly when the power is cut: data fades over seconds, and much more slowly if the chips are cold. Researchers showed in 2008 that someone with physical access could cut the power on a running laptop, restart it from their own USB stick (or move the cooled memory to another computer) and read what was left, including encryption keys.

Other memory attacks use fast ports like Thunderbolt to read memory directly from a running computer.

What has changed since then

• Some modern computers can encrypt the memory itself (many AMD and Intel business laptops support this when it is turned on in the firmware settings), which makes these attacks much harder.
• Memory is often soldered to the board in modern laptops, so it cannot easily be removed.
• Operating systems now protect ports like Thunderbolt and USB4 from direct memory access, especially when the computer is locked.
• Phones like Google Pixels running GrapheneOS keep keys in a secure chip and clear memory on restart. A phone that has been restarted and not unlocked is in its strongest state.

These attacks are still real for a determined, well-funded attacker with your device in hand, especially against older computers.

How to protect yourself

1. Shut down instead of sleep when you leave your computer, travel, or cross a border. Sleep keeps the keys in memory; a full shutdown clears them.
2. Turn off hibernation, or make sure the hibernation file is encrypted (it is when full-disk encryption is on).
3. Set your computer to ask for the disk password at start-up (BitLocker with a PIN, FileVault, LUKS), not just to unlock automatically.
4. Use Tails for sensitive work: it wipes the memory when it shuts down, including when you pull out the USB stick.
5. Phones: turn on GrapheneOS auto reboot, and restart your phone before situations where it might be taken.
6. Keep your firmware (BIOS) updated, and turn on memory encryption in its settings if your computer supports it.