December 2018
Beginner to intermediate
328 pages
8h 29m
English
Any data that is written to the flash memory must pass through RAM; there is no other way for the processor to communicate with the flash memory. This means that almost anything done on the device may be found in the contents of a RAM dump. Depending on the amount of device usage, data may remain in RAM indefinitely, until it needs to be overwritten. RAM dumps frequently contain text that's been typed on the device, including usernames and passwords, and application data that is not stored permanently on the device. For example, the Facebook application used to store the contents of a user's News Feed in a database in its application folder. Newer versions do not save the user's News Feed, but it exists in RAM.
Read now
Unlock full access