iPhone Takes Screenshots of Everything You Do

Just killing a process will leave its core intact in memory until the pages are reused by the operating system. If the computer is then hibernated (and by default Mac OS X writes hibernation data when you suspend it), a memory dump is written to disk that may include this data. If a process was manipulating sensitive data -- cleartext passwords, cryptographic keys, or so forth -- then that data may be persisted even after a program is killed.

The good thing is that, as far as I know, most operating systems use a first-in first-out page allocation algorithm. This means that newly-freed pages will be given out first, so the life-span of this "zombie data" will probably be short.

Also good news is that RAM is volatile by nature, so it doesn't store "imprints" like hard drives may after a write. If a byte of RAM is overwritten, all traces of the old data is gone within a few nanoseconds. This means that if you are paranoid about this sort of data leak, you should zero sensitive memory buffers before returning them to the system.

I know a bit about the analagous problems with hard drives, if you're interested.

I believe what the article referred to is unlinking of files.

The way most operating systems delete files is by removing just the inode entry for that file, and leave all data on the device to be overwritten at some later time. This way, forensics tools recover files that still reside in bits and pieces in blocks on file systems that aren't currently assigned to any file. Same technique applies to recovering these buffer images that the article talks about.

Same story is with deallocating memory. A process will no longer claim a certain block of memory once it's not needed, but not actually overwrite the area with zeroes. Operating systems generally take the approach to not doing anything they don't have to for the sake of efficiency.

There are tools however that will wipe the actual data multiple times before removing the inode (reference to that data) such that it makes it much more difficult to recover it. They do so multiple times due to magnetic traces on the actual drives that data leaves even when it's over written. RAM does not need to be overwritten multiple times, as far as I'm aware since it is a lot more transient.

Also, if same files remained on your hard drive for a long time (years), overwriting it many times might simply not be enough as the data literally seeps deeper and deeper into the platter and might be recoverable with a precision shaving of platter material. I heard this evidence anecdotally, so take it at face value.

Hold down the power button and hit the button on the front once - you'll get a white flash and a screen shot will be saved to your photos folder.