How can I securely delete pagefile.sys and hiberfil.sys?


  1. Posts : 22
    Windows 7 Home Premium 64-bit
       #1

    How can I securely delete pagefile.sys and hiberfil.sys?


    I run Windows 7-64 bit Home Premium and work on encrypted containers with TrueCrypt. I'm afraid that such sensitive information (including passwords) may be unencrypted on pagefile.sys or hiberfile.sys. How can I securely delete both of these files? I know there's a method in Windows 7 to delete pagefile.sys at shutdown but I heard from different sources on the net, this is unreliable and does not in fact SECURELY delete the content inside pagefile.sys. Any suggestions?
      My Computer


  2. Posts : 687
    Microsoft Windows 10 Professional / Windows 7 Professional
       #2

    Just disable them and wipe the free space with 0's after that?
      My Computer


  3. Posts : 6,349
    Windows7 Pro 64bit SP-1; Windows XP Pro 32bit
       #3

    This will disable hyberfil. It works I have it set disabled on my SSD.> Hibernate - Enable or Disable

    I'll post back on page file when I find it.
      My Computer


  4. Posts : 19,383
    Windows 10 Pro x64 ; Xubuntu x64
       #4

    Hi Problemo,

    You might want to try Mark Russinovich's SDELETE, from here

    SDelete

    It runs from the CMD command line. SDELETE is DoD 5220.22-M compliant. A single pass should be sufficient for your needs.

    Regards,
    Golden
      My Computer


  5. Posts : 24,479
    Windows 7 Ultimate X64 SP1
       #5

    Page File Encryption - Enable or Disable
    This will help with the pagefile.
      My Computer


  6. Posts : 6,349
    Windows7 Pro 64bit SP-1; Windows XP Pro 32bit
       #6

    The only two things I found in sevenforums tutorials is to move the page file to a different hard drive or this> Page File Encryption - Enable or Disable

    Encryption.
    All I could find.
    Good luck.
    Mike
      My Computer


  7. Posts : 1
    Windows XP and Windows 7
       #7

    sdelete and truecrypt


    From a forensic standpoint your data is always on your hard drive the only way to securely get rid of it is to write zeros over that data numerous times. However you DO NOT want to delete or overwrite the pagefile.sys as its a critical system file and Windows caches much of its data on to it. For non system critical files you may want to use sdelete by sysinternals the command is sdelete -p <Times to write over> <File or Directory Path>. E.g. sdelete -p 15 "c:\textfile".

    Someone mentioned Truecrypt, it is very stable and very secure. You should use AES 256-bit encryption which has not been cracked.
      My Computer


  8. Posts : 1,781
    Windows 7 Professional SP1 32-bit
       #8

    pagefile.sys is not a cache for anything stored on the disk, it just stores data paged out of system RAM. It's virtual memory. Of course that doesn't mean it's any less likely to contain unencrypted data that was worked with at any point in time.

    The only 100% reliable solution against leaving any unencrypted remnants behind is to encrypt the Windows system partition itself, including the pagefile.sys stored within it as well as any and all cache and temporary files created or modified during a Windows session.

    (However, it depends on what's on those Truecrypt-encrypted volumes and how the OP is working with their contents in the first place.)

    Another effective, though uncommon, method is to use software to automatically create and format a fixed-size RAM disk at boot time and allocate it with a pagefile.sys, enabling you to keep the pagefile out of any disk-based volumes without having to disable it altogether. Of course using a RAM disk to store a file that's used as virtual memory is a bit...backward.

    (I do this on my laptop though, since it has a full 1GB of RAM that my 32-bit Windows can't see but my RAM disk software is able to use separately.)

    Clearing the pagefile.sys file at every Windows shutdown is an obvious and simple method requiring a single registry key change which is pretty trivial, but it'll delay the shutdown a lot, and this doesn't address the remaining issue of various cache and temp files left behind on the system volume.

    For the record: Clear the page file at shutdown
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 17:02.
Find Us