Windows 7: Can the page file be read?

whs · 01 Oct 2012

Gary, let's go back to basics.

The pagefile is an 'extension' of your RAM. Whenever you run short of RAM and there is a request by a program for RAM, Superfetch will page-out the lowest priority (the one that has not been used for the longest time) part of the occupied RAM in order to make room for the new request. Now that could be anything that happens to linger around in RAM at this point in time.

The good news is that with our modern PCs that have 4GB or more of RAM, chances are slim that anything gets paged out at any time. The page requests (hard faults) that you may see e.g. in the Resource Monitor are mostly fake paging requests. Those occur because Superfetch uses the paging mechanism to populate RAM without really populating the page file.

Britton30 · 01 Oct 2012

Quote: Originally Posted by logicearth

Furthermore, if your laptop is stolen do you honestly think someone would care enough to pull fragments of your personal information that may or may not be contained in the pagefile when they now have unrestricted access to your personal information stored on the computer in full. Or passwords stored in the browsers log in cache. Why would they bother with the pagefile? (BTW, encryption keys are already protected from being paged out in the first place, they will not be contained in the pagefile.)

Look, none of your comments have had any bearing on my original question. I don't have a laptop, please read the comments.

MilesAhead · 01 Oct 2012

Quote: Originally Posted by Britton30

Since there is much discussion of overwriting the pagefile.sys I am wondering is there a way to read its contents?

I'd also like to view contents of thumbs.db (I think) just to see what if any info is stored in them.

The storage tends to be data allocated by programs. For example, if I wrote a program that changes a graphics file from one format to another, I might allocate a few hundred MB for a buffer to read the whole file into. If memory is short on the system, when another app needs memory, my data may be "swapped out" to the page file.

Program code is considered to already be "paged" in the exe file that sits on disk. That's one reason why the OS frowns on altering code in memory. That and security/malware reasons. But if you can alter the code in ram then the image on disk is not an accurate copy anymore etc..

If your machine was actually some financial server or constantly processed credit card info, then you may want to encrypt the page file for security.

Here's a couple of links with some more info.

Pagefile.sys - Forensics Wiki

Encrypt Your Windows Pagefile To Improve Security

One way to read your pagefile would be to boot a Linux CD and use a hex editor to view it. Likely some of the contents would be text. Skimming it you would likely find sections with readable text.

logicearth · 01 Oct 2012

Quote: Originally Posted by Britton30

Look, none of your comments have had any bearing on my original question. I don't have a laptop, please read the comments.

My last post was not directed at you.

Britton30 · 01 Oct 2012

Quote: Originally Posted by whs

Gary, let's go back to basics.

The pagefile is an 'extension' of your RAM. Whenever you run short of RAM and there is a request by a program for RAM, Superfetch will page-out the lowest priority (the one that has not been used for the longest time) part of the occupied RAM in order to make room for the new request. Now that could be anything that happens to linger around in RAM at this point in time.

The good news is that with our modern PCs that have 4GB or more of RAM, chances are slim that anything gets paged out at any time. The page requests (hard faults) that you may see e.g. in the Resource Monitor are mostly fake paging requests. Those occur because Superfetch uses the paging mechanism to populate RAM without really populating the page file.

Quote: Originally Posted by MilesAhead

The storage tends to be data allocated by programs. For example, if I wrote a program that changes a graphics file from one format to another, I might allocate a few hundred MB for a buffer to read the whole file into. If memory is short on the system, when another app needs memory, my data may be "swapped out" to the page file.

Program code is considered to already be "paged" in the exe file that sits on disk. That's one reason why the OS frowns on altering code in memory. That and security/malware reasons. But if you can alter the code in ram then the image on disk is not an accurate copy anymore etc..

If your machine was actually some financial server or constantly processed credit card info, then you may want to encrypt the page file for security.

Here's a couple of links with some more info.

Pagefile.sys - Forensics Wiki

Encrypt Your Windows Pagefile To Improve Security

One way to read your pagefile would be to boot a Linux CD and use a hex editor to view it. Likely some of the contents would be text. Skimming it you would likely find sections with readable text.

Thanks!

Britton30 · 01 Oct 2012

Quote: Originally Posted by logicearth

Quote: Originally Posted by Britton30

Look, none of your comments have had any bearing on my original question. I don't have a laptop, please read the comments.

My last post was not directed at you.

My appologies.

Layback Bear · 01 Oct 2012

This might be of some interest. Couldn't find it our Tutorials.
How to Clear Virtual Memory Pagefile upon shutdown in Windows 7?

Britton30 · 01 Oct 2012

Thanks Jack, it is here.

Virtual Memory Paging File - Clear at Shutdown - Vista Forums

A Guy · 01 Oct 2012

That will make for a very slow shutdown BTW. It is something to consider when an OP complains of slow shutdown. A Guy

Britton30 · 01 Oct 2012

Quote: Originally Posted by A Guy

That will make for a very slow shutdown BTW. It is something to consider when an OP complains of slow shutdown. A Guy

True, it went from ~48 seconds to 62 for a reboot.

Windows 7: Can the page file be read?

Can the page file be read? problems?