Can the page file be read?

[whs]

Gary, let's go back to basics.

The pagefile is an 'extension' of your RAM. Whenever you run short of RAM and there is a request by a program for RAM, Superfetch will page-out the lowest priority (the one that has not been used for the longest time) part of the occupied RAM in order to make room for the new request. Now that could be anything that happens to linger around in RAM at this point in time.

The good news is that with our modern PCs that have 4GB or more of RAM, chances are slim that anything gets paged out at any time. The page requests (hard faults) that you may see e.g. in the Resource Monitor are mostly fake paging requests. Those occur because Superfetch uses the paging mechanism to populate RAM without really populating the page file.

 

[Britton30]

Furthermore, if your laptop is stolen do you honestly think someone would care enough to pull fragments of your personal information that may or may not be contained in the pagefile when they now have unrestricted access to your personal information stored on the computer in full. Or passwords stored in the browsers log in cache. Why would they bother with the pagefile? (BTW, encryption keys are already protected from being paged out in the first place, they will not be contained in the pagefile.)

Look, none of your comments have had any bearing on my original question. I don't have a laptop, please read the comments.

 

[MilesAhead]

Since there is much discussion of overwriting the pagefile.sys I am wondering is there a way to read its contents?

I'd also like to view contents of thumbs.db (I think) just to see what if any info is stored in them.

The storage tends to be data allocated by programs. For example, if I wrote a program that changes a graphics file from one format to another, I might allocate a few hundred MB for a buffer to read the whole file into. If memory is short on the system, when another app needs memory, my data may be "swapped out" to the page file.

Program code is considered to already be "paged" in the exe file that sits on disk. That's one reason why the OS frowns on altering code in memory. That and security/malware reasons. But if you can alter the code in ram then the image on disk is not an accurate copy anymore etc..

If your machine was actually some financial server or constantly processed credit card info, then you may want to encrypt the page file for security.

Here's a couple of links with some more info.

Pagefile.sys - Forensics Wiki

Encrypt Your Windows Pagefile To Improve Security

One way to read your pagefile would be to boot a Linux CD and use a hex editor to view it. Likely some of the contents would be text. Skimming it you would likely find sections with readable text.

 

[logicearth]

Look, none of your comments have had any bearing on my original question. I don't have a laptop, please read the comments.

My last post was not directed at you.

 

[Britton30]

Gary, let's go back to basics.

The pagefile is an 'extension' of your RAM. Whenever you run short of RAM and there is a request by a program for RAM, Superfetch will page-out the lowest priority (the one that has not been used for the longest time) part of the occupied RAM in order to make room for the new request. Now that could be anything that happens to linger around in RAM at this point in time.

The good news is that with our modern PCs that have 4GB or more of RAM, chances are slim that anything gets paged out at any time. The page requests (hard faults) that you may see e.g. in the Resource Monitor are mostly fake paging requests. Those occur because Superfetch uses the paging mechanism to populate RAM without really populating the page file.

The storage tends to be data allocated by programs. For example, if I wrote a program that changes a graphics file from one format to another, I might allocate a few hundred MB for a buffer to read the whole file into. If memory is short on the system, when another app needs memory, my data may be "swapped out" to the page file.

Program code is considered to already be "paged" in the exe file that sits on disk. That's one reason why the OS frowns on altering code in memory. That and security/malware reasons. But if you can alter the code in ram then the image on disk is not an accurate copy anymore etc..

If your machine was actually some financial server or constantly processed credit card info, then you may want to encrypt the page file for security.

Here's a couple of links with some more info.

Pagefile.sys - Forensics Wiki

Encrypt Your Windows Pagefile To Improve Security

One way to read your pagefile would be to boot a Linux CD and use a hex editor to view it. Likely some of the contents would be text. Skimming it you would likely find sections with readable text.

Thanks!

 

[Britton30]

Look, none of your comments have had any bearing on my original question. I don't have a laptop, please read the comments.

My last post was not directed at you.

My appologies.

 

[Layback Bear]

This might be of some interest. Couldn't find it our Tutorials.
How to Clear Virtual Memory Pagefile upon shutdown in Windows 7?

 

[Britton30]

Thanks Jack, it is here.
Virtual Memory Paging File - Clear at Shutdown - Vista Forums

 

[A Guy]

That will make for a very slow shutdown BTW. It is something to consider when an OP complains of slow shutdown. A Guy

 

[Britton30]

That will make for a very slow shutdown BTW. It is something to consider when an OP complains of slow shutdown. A Guy

True, it went from ~48 seconds to 62 for a reboot.

 

[A Guy]

That will make for a relatively very slow shutdown BTW. It is something to consider when an OP complains of slow shutdown. A Guy

True, it went from ~48 seconds to 62 for a reboot.

A Guy

 

[pincushion]

I don't think it is besides the point at all. It's just a matter of my own curiosity. My computer is a 50 pound desktop so I'm not leaving it laying around.

You think thieves only steal laptops? I agree it is not likely but then all accidents are unlikely. If one has security in mind then it should be applied to ALL areas - chinks in the armour is what leads to problems. It is not especially cautious or difficult to secure the pagefile.

 

[pincushion]

Furthermore, if your laptop is stolen do you honestly think someone would care enough to pull fragments of your personal information that may or may not be contained in the pagefile when they now have unrestricted access to your personal information stored on the computer in full. Or passwords stored in the browsers log in cache. Why would they bother with the pagefile? (BTW, encryption keys are already protected from being paged out in the first place, they will not be contained in the pagefile.)

Probably not but since it is not difficult to secure the pagefile I think it is just an additional step to make sure ANY of my personal information is not available to Mr.Thief or anyone else. Why have half-hearted security? I apply this philosophy across the board in erasing all temporary Internet Files, storing passwords in encrypted form (RoboForm) and storing all personal data in encrypted containers (Truecrypt). Why leave holes in your security?

:huh:

 

[MilesAhead]

Thanks Jack, it is here.
Virtual Memory Paging File - Clear at Shutdown - Vista Forums

Since you are running 16 GB ram the overhead of clearing the page file may be a good argument for running without one. Depends on the system load. I know on my 8 GB machine, I never felt the need to run one. In that case the main thing would be to set up a mechanism to scrub your temp files. Depends how far you want to take it.

 

[UsernameIssues]

Since there is much discussion of overwriting the pagefile.sys I am wondering is there a way to read its contents?

I'd also like to view contents of thumbs.db (I think) just to see what if any info is stored in them.

Both of these questions have been answered a number of times, but here is my 2 cents:

Booting a W7 VM to Ubuntu, installing GHex and looking at that file.



I'm holding down the page down key and the info being displayed it not contiguous.

The page file was set to a minimum of 16MB and you can see that after 3 minutes of sampling, I've barely moved the scroll bar. Don't read anything into that - I'm not suggesting security thru obscurity - I'm just sayin': image what a GB or two would be like.

You can do electronic searches - if you know what you want to look for. The VM had 1.5GB of RAM assigned. I opened a text file and did a copy/paste of the letters "za" until Windows said it was out of resources (wouldn't even let me save the file). I did not find any of the text in the page file via electronic search.

 

[MilesAhead]

When looking through a giant file it's important to use an editor that doesn't try to load the entire file in ram. There should be some hex editors that load off the file in a certain locus. IOW, if you hit the key to go to the end of file, it may read from 1/2 MB before end of file to the end etc..

Esp. with hex edit there should be some that can handle "files of unlimited size." I would think this more common in Linux than Windows. But even in Windows apps there should be some. But they might not be free.

http://en.wikipedia.org/wiki/Comparison_of_hex_editors

 

[Britton30]

I was considering running with no pagefile but WHS, Kari, and Brink recommend have at least a small one because some software (old ones?) look for a page file regardless of the RAM installed. I currently have it set to min 1024MB and max 4096MB.

Nice list of hex editors Miles. Thanks for the video UsernameIssues.

No one has mentioned the thumbs.db yet.

@Bill, yup it is relative.

 

[UsernameIssues]

.....Thanks for the video UsernameIssues.

No one has mentioned the thumbs.db yet.....

You are welcome...

...and look at post #6:

Thumbs.db viewer and cleaner

A Guy

 

[Britton30]

...and look at post #6:

Thumbs.db viewer and cleaner

A Guy

 

[MilesAhead]

I was considering running with no pagefile but WHS, Kari, and Brink recommend have at least a small one because some software (old ones?) look for a page file regardless of the RAM installed. I currently have it set to min 1024MB and max 4096MB.

My scheme when running a page file has always been to delete it, then defrag my drive. Then set the min and max the same. Once done the page file never becomes fragmented. If your virtual memory needs are predictable then my strategy works fine. If you use wildly fluctuating giant databases then another scheme may work better.

I've never needed to use Office type applications, so for me it hasn't been an issue. On my dual core machine I only have 2 GB ram. I can get away with no swap, but prefetch seems to work more smoothly with a page file. It's something to experiment with if you have spare time.