Unencrypted Data in RAM
It is important to note that TrueCrypt is disk encryption software, which encrypts only disks, not RAM (memory).
Keep in mind that most programs do not clear the memory area (buffers) in which they store unencrypted (portions of) files they load from a TrueCrypt volume. This means that after you exit such a program, unencrypted data it worked with may remain in memory (RAM) until the computer is turned off (and, according to some researchers, even for some time after the power is turned off*). Also note that if you open a file stored on a TrueCrypt volume, for example in a text editor, and then force dismount the TrueCrypt volume, the file will remain unencrypted in the memory (RAM) allocated to the text editor. This applies to forced auto-dismount too.
Inherently, unencrypted master keys have to be stored in RAM too. When a non‑system TrueCrypt volume is dismounted, TrueCrypt erases its master keys (stored in RAM). When the computer is cleanly restarted (or shut down), all non‑system TrueCrypt volumes are automatically dismounted and all master keys stored in RAM are erased by the TrueCrypt driver (except master keys for system partitions/drives — see below). However, when power is abruptly interrupted, when the computer is reset (not cleanly restarted), or when the system crashes, TrueCrypt naturally stops running and therefore cannot erase any keys or other sensitive data. Furthermore, as Microsoft does not provide any appropriate API for handling hibernation and shutdown, master keys used for system encryption cannot be reliably (and are not) erased from RAM when the computer hibernates, is shut down, or restarted.**
| To summarize, TrueCrypt cannot and does not ensure that RAM contains no sensitive data (e.g. passwords, master keys, or decrypted data). Therefore, after each session in which you work with a TrueCrypt volume or an encrypted operating system is running, you must shut down (or, if the hibernation file is encrypted, hibernate) the computer and leave it powered off for at least several minutes (the longer, the better) before turning it on again. This is required to clear the RAM. |
* Allegedly, for 1.5–35 seconds under normal operating temperatures (26–44 °C) and up to several hours when the memory modules are cooled (while the computer is running) to very low temperatures (e.g. –50 °C). New types of memory modules allegedly exhibit a much shorter decay time (e.g. 1.5–2.5 seconds) than older types (as of 2008).
** Before a key can be erased from RAM, the corresponding TrueCrypt volume must be dismounted. For non‑system volumes this is not a problem. However, as Microsoft currently does not provide an API for handling the final phase of system shutdown, paging files on encrypted system volumes dismounted during shutdown may still contain valid swapped‑out memory pages (including portions of Windows system files). This could cause “blue screen” errors. Therefore, to prevent such errors, TrueCrypt does not dismount encrypted system volumes and consequently cannot clear their master keys when the system is shut down or restarted.