2

From my research so far, Linux is moving away from allowing access to physical memory via the /dev/mem file. Unfortunately this is the case on Ubuntu 11.10, as /dev/mem does not exist.

Further research turned up the shm file as a way to pass memory between programs (http://www.cyberciti.biz/tips/what-is-devshm-and-its-practical-usage.html). This is to try to learn if /dev/shm is a valid substitute for hexdumping the contents of physical memory, e.g., 

dd if=/dev/shm bs=1024 count=10485576|hexdump -C > recovery.txt

Failing this, is there an alternate route to access physical memory in Linux when there is no /dev/mem?

Matt Hulse
  • 5,496
  • 4
  • 29
  • 37
Literati Insolitus
  • 508
  • 2
  • 6
  • 13

1 Answers1

1

You can't use /dev/shm this way, it's a temporary filesystem that only provides a way to access information specifically stored in it.

You are right that you can't easily use /dev/mem this way. What's your use case? There's a probably a way to do what you want to do.

Community
  • 1
  • 1
David Schwartz
  • 179,497
  • 17
  • 214
  • 278
  • Dear David, thanks for answering. This isn't meant to be a part of a generalized process with an end user and Linux. There was some significant data in the gedit undo buffer pinched off by a mistaken keystroke, and the hope was the relevant RAM was not overwritten by any subsequent actions and could be recovered via this avenue. – Literati Insolitus Nov 14 '11 at 22:35
  • In that case, dump the virtual memory of the gedit process (`/proc//mem`) If it's anywhere, it'll be there. – David Schwartz Nov 14 '11 at 23:23