I was working on a live Linux Mint MATE installation medium, but my laptop shut down.
Is this data gone, or could I potentially recover it using data recovery tools?
New contributor
Niles Ilias Corder is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Add a comment
|
2 Answers
If you haven’t explicitly configured anything for persistent storage, or if there was an option and you didn’t use it, and you also haven’t saved anything to another medium during your work, then everything that was in RAM should be gone.
RAM is volatile: as soon as the computer is turned off or power is lost, all the data in it disappears.
Except if the computer goes into standby or something similar, where the data gets saved to swap space on a device or something like that but that option has to exist, or it has to be configured/enabled first.
-
6Technically, RAM contents doesn't disappear instantly, due to an effect known as data remanence. It takes seconds for memory to disappear, but simple compressed gas changes it to minutes and liquid nitrogen turns it into hours. While it's not relevant here, we don't know if somebody won't see that and think of it as a fact, hence I think it's important to not share myths or oversimplifications. In this case it's a huge security concern.Krzysiu– Krzysiu2026-02-01 16:31:55 +00:00Commented 2 days ago
-
10@Krzysiu The answer is neither a myth nor an oversimplification and does not pose a significant security risk! What you are describing would mean that a state, an intelligence agency, or some other institution storms into your room and, at the very moment you try to shut down your computer, uses these methods to access your data. I think you are exaggerating radically here!ReflectYourCharacter– ReflectYourCharacter2026-02-01 16:53:58 +00:00Commented 2 days ago
-
7@Krzysiu You can post a reply or a question about this in a security forum if you have precise information. But only if you actually know what you’re talking about in practice, not just because you once read something about it in theory. It’s the same as if I were to say that quantum computers make all hashing and encryption insecure.ReflectYourCharacter– ReflectYourCharacter2026-02-01 17:00:57 +00:00Commented 2 days ago
Whatever in-memory data you were using is gone with 98% certainty.
If the computer had a swap partition some live cd/dvd/usb use them automatically (there's quite a variation, a few will do that automatically while others prefer not to touch the disk at all). However, (1) an install medium is unlikely to do that and (2) even if a swap partition was mounted, it would only be used if there was not enough memory available, and (3) even in that case, the data with which you were running are the less likely to have been swapped.
If you were working on a live media, but on an on-disk partition, then data may be recoverable from that partition (it depends on what kind of programs you were using).
