Can the page file be read?

A Guy · 01 Oct 2012

Britton30 said:

A Guy said:

That will make for a relatively very slow shutdown BTW. It is something to consider when an OP complains of slow shutdown. A Guy

True, it went from ~48 seconds to 62 for a reboot.

A Guy

pincushion · 02 Oct 2012

Britton30 said:

I don't think it is besides the point at all. It's just a matter of my own curiosity. My computer is a 50 pound desktop so I'm not leaving it laying around.

You think thieves only steal laptops? I agree it is not likely but then all accidents are unlikely. If one has security in mind then it should be applied to ALL areas - chinks in the armour is what leads to problems. It is not especially cautious or difficult to secure the pagefile.

pincushion · 02 Oct 2012

logicearth said:

Furthermore, if your laptop is stolen do you honestly think someone would care enough to pull fragments of your personal information that may or may not be contained in the pagefile when they now have unrestricted access to your personal information stored on the computer in full. Or passwords stored in the browsers log in cache. Why would they bother with the pagefile? (BTW, encryption keys are already protected from being paged out in the first place, they will not be contained in the pagefile.)

Probably not but since it is not difficult to secure the pagefile I think it is just an additional step to make sure ANY of my personal information is not available to Mr.Thief or anyone else. Why have half-hearted security? I apply this philosophy across the board in erasing all temporary Internet Files, storing passwords in encrypted form (RoboForm) and storing all personal data in encrypted containers (Truecrypt). Why leave holes in your security?

MilesAhead · 02 Oct 2012

Britton30 said:

Thanks Jack, it is here.

Virtual Memory Paging File - Clear at Shutdown - Vista Forums

Since you are running 16 GB ram the overhead of clearing the page file may be a good argument for running without one. Depends on the system load. I know on my 8 GB machine, I never felt the need to run one. In that case the main thing would be to set up a mechanism to scrub your temp files. Depends how far you want to take it.

UsernameIssues · 02 Oct 2012

Britton30 said:

Since there is much discussion of overwriting the pagefile.sys I am wondering is there a way to read its contents?

I'd also like to view contents of thumbs.db (I think) just to see what if any info is stored in them.

Both of these questions have been answered a number of times, but here is my 2 cents:

Booting a W7 VM to Ubuntu, installing GHex and looking at that file.

I'm holding down the page down key and the info being displayed it not contiguous.

The page file was set to a minimum of 16MB and you can see that after 3 minutes of sampling, I've barely moved the scroll bar. Don't read anything into that - I'm not suggesting security thru obscurity - I'm just sayin': image what a GB or two would be like.

You can do electronic searches - if you know what you want to look for. The VM had 1.5GB of RAM assigned. I opened a text file and did a copy/paste of the letters "za" until Windows said it was out of resources (wouldn't even let me save the file). I did not find any of the text in the page file via electronic search.

MilesAhead · 02 Oct 2012

When looking through a giant file it's important to use an editor that doesn't try to load the entire file in ram. There should be some hex editors that load off the file in a certain locus. IOW, if you hit the key to go to the end of file, it may read from 1/2 MB before end of file to the end etc..

Esp. with hex edit there should be some that can handle "files of unlimited size." I would think this more common in Linux than Windows. But even in Windows apps there should be some. But they might not be free.

http://en.wikipedia.org/wiki/Comparison_of_hex_editors

Britton30 · 02 Oct 2012

I was considering running with no pagefile but WHS, Kari, and Brink recommend have at least a small one because some software (old ones?) look for a page file regardless of the RAM installed. I currently have it set to min 1024MB and max 4096MB.

Nice list of hex editors Miles. Thanks for the video UsernameIssues.

No one has mentioned the thumbs.db yet.

@Bill, yup it is relative.

UsernameIssues · 02 Oct 2012

Britton30 said:

.....Thanks for the video UsernameIssues.

No one has mentioned the thumbs.db yet.....

You are welcome...

...and look at post #6:

A Guy said:

Thumbs.db viewer and cleaner

A Guy

Britton30 · 02 Oct 2012

UsernameIssues said:

...and look at post #6:

A Guy said:

Thumbs.db viewer and cleaner

A Guy

MilesAhead · 02 Oct 2012

Britton30 said:

I was considering running with no pagefile but WHS, Kari, and Brink recommend have at least a small one because some software (old ones?) look for a page file regardless of the RAM installed. I currently have it set to min 1024MB and max 4096MB.

My scheme when running a page file has always been to delete it, then defrag my drive. Then set the min and max the same. Once done the page file never becomes fragmented. If your virtual memory needs are predictable then my strategy works fine. If you use wildly fluctuating giant databases then another scheme may work better. :)

I've never needed to use Office type applications, so for me it hasn't been an issue. On my dual core machine I only have 2 GB ram. I can get away with no swap, but prefetch seems to work more smoothly with a page file. It's something to experiment with if you have spare time. :)