Suspend to Swap

• Incorporated into Linux 2.5.x kernel source

  • But Magic SysRq D is being deprecated

• Intended to allow laptops to suspend to swap

• Flushes cache (sync)

• Compacts kernel dataspace and memory

• Saves memory to swap

• Saves machine state to swap

• Risk - Potentially sensitive information could end up on swap even if in protected memory!

• Advantage - System images are restartable and can be analyzed "in vitro" upon restart!

• Requires preparation and effort. :-(

Notes: