Completely disable SWAP

Syrrace · 11-26-2008, 03:34 PM

Is there a method to DISABLE the use of swap space (not to delete it) using a LiveCD (maybe from boot)?

- - -

I have created my own Ubuntu-based live distro for Computer Forensics, but the swap issue is a big problem!

When I boot my distro on the suspect PC, with installed a Linux OS, it is highly probable that would be a previously formatted swap space (like /dev/sda5, for example). And the livecd use this space as its own swap space.

The solutions I tried are many: mainly I tried to edit mountall.sh and checkroot.sh files (in /etc/init.d), and I even edit the line of the swap partition in /etc/fstab:

Code:

#From this
/dev/sda5 swap swap defaults 0 0
#To this
/dev/sda5 none swap ro 0 0

But... no way! If the system is in shortage of RAM, goes to the swap partition instead.

So, this is my situation... Can you give me a hand?

Thank you anyway!

Disillusionist · 11-26-2008, 03:51 PM

You can turn swap off (as root) by using the following command:

Code:

swapoff -a

This doesn't permanently disable the swap partition however (just turns it off until reboot or a swapon -a command)

syg00 · 11-26-2008, 04:05 PM

Too late - once mounted it is compromised from a forensics point of view.
The OP will need to compile a kernel with CONFIG_SWAP=N

Disillusionist · 11-26-2008, 04:08 PM

Sorry, hadn't read the OP's scenario properly!

internetSurfer · 11-26-2008, 06:49 PM

Not tested but worth a look into embedding dynswapd into the livecd:

Quote:

dynswapd - Dynamic Swap Daemon
http://dynswapd.sourceforge.net/

Dynamically de/activates swap files and partitions as required,
creating and deleting swap files as necessary.

Disillusionist · 11-27-2008, 12:52 AM

internetSurfer:
As pointed out by syg00 this is for forensic investigation.

If you mount the swap partition of the suspect machine, that swap partition is compromised from a forensics point of view.

internetSurfer · 11-27-2008, 01:00 AM

@Disillusionist

I understand the problem being presented.

unSpawn and I have had this conversation before.
I tend to forget to elaborate on a link or info I post.

Just tossing around the idea of maybe using this program
and configuring the daemon on boot to disable the swap of
the OS being checked and configuring/adding a swap for
analysis.

Example:

livecd goes in
gparted/dynswapd opens up
reconfigs swap
livecd boots
forensic analysis begins

_

Syrrace · 11-27-2008, 07:09 AM

Quote:

Originally Posted by Disillusionist

You can turn swap off (as root) by using the following command:

Code:

swapoff -a

This doesn't permanently disable the swap partition however (just turns it off until reboot or a swapon -a command)

So... I think I did it, without the kernel compilation... I use the command "swapon -a" and now the swap partition is set in fstab as:

Code:

/dev/sda5 none swap ro,noauto 0 0

I'm trying it on a PC with 2 GB of RAM memory... Yes, I know, too much RAM.
So I used a little trick: I'm using memtester with the value 2000 to fill the RAM. The RAM is filled, but it doesn't swap. The swap remains untouched, md5 certified it.

Do you think it is forensic compliant this method? I think that memtester is secure, but can you suggest me a better method to fill the ram? Something like a little C code with a malloc, maybe?

Thank you...

AuroraCA · 11-27-2008, 07:23 AM

From a forensics point of view you should not be using the hard disk at all. You should make a copy of it and use the copy. To examine the disk you would then mount it in another system for access to the files.