View Single Post
01 Oct 2012  
Microsoft MVP

Windows 7 Ultimate X64 SP1

Quote   Quote: Originally Posted by whs View Post
Gary, let's go back to basics.

The pagefile is an 'extension' of your RAM. Whenever you run short of RAM and there is a request by a program for RAM, Superfetch will page-out the lowest priority (the one that has not been used for the longest time) part of the occupied RAM in order to make room for the new request. Now that could be anything that happens to linger around in RAM at this point in time.

The good news is that with our modern PCs that have 4GB or more of RAM, chances are slim that anything gets paged out at any time. The page requests (hard faults) that you may see e.g. in the Resource Monitor are mostly fake paging requests. Those occur because Superfetch uses the paging mechanism to populate RAM without really populating the page file.
Quote   Quote: Originally Posted by MilesAhead View Post
The storage tends to be data allocated by programs. For example, if I wrote a program that changes a graphics file from one format to another, I might allocate a few hundred MB for a buffer to read the whole file into. If memory is short on the system, when another app needs memory, my data may be "swapped out" to the page file.

Program code is considered to already be "paged" in the exe file that sits on disk. That's one reason why the OS frowns on altering code in memory. That and security/malware reasons. But if you can alter the code in ram then the image on disk is not an accurate copy anymore etc..

If your machine was actually some financial server or constantly processed credit card info, then you may want to encrypt the page file for security.

Here's a couple of links with some more info.

Pagefile.sys - Forensics Wiki

Encrypt Your Windows Pagefile To Improve Security

One way to read your pagefile would be to boot a Linux CD and use a hex editor to view it. Likely some of the contents would be text. Skimming it you would likely find sections with readable text.
My System SpecsSystem Spec