Many discussions of FileVault 2 security suggest using:
sudo pmset -a destroyfvkeyonstandby 1 hibernatemode 25
Some of those discussion state that FileVault keys are stored in RAM during normal awake use whereas others say that they are stored in EFI firmware.
Where are the keys stored while the machine is awake and running- in RAM or in firmware?
What, precisely, does
destroyfvkeyonstandbydo? For example, if I delete a file I can recover it because it is not wiped. Does
destroyfvkeyonstandbyperform a memory release (delete) or a wipe (overwriting the memory that was being used to hold the key)?
If I use
destroyfvkeyonstandby, what benefit is there to going into hibernation mode immediately (other than saving energy)? If the key has been wiped, what danger is there in leaving the RAM powered on?