Not True! In the settings of Eraser (for Win2k and Xp, I am sure there
is a setting for cleaning the swap file.
I know that BcWipe claioms to wipe the swap drive. his file cannot be
accessed while booted into Windows though. The system has it locked.
BcWipe commits a whole bunch to memory, assuming that the data will be
written to the swap file. According to the Eraser site, this might
make things worse, as sensitive data in memory that would not be
written to disk is forced to be written.
I don't think that Eraser can do the swap file either. That was a
quote from the home site.
http://www.tolvanen.com/eraser/faq.shtml
"Q: "I heard that Windows' swap (or paging) file may contain sensitive
information. Why doesn't Eraser take care of this?"
A: When starting, Windows opens the swap (or paging) file with
exclusive access, preventing any application from accessing it. This
is quite understandable as messing with the virtual memory while
Windows is running would probably crash the system.
Eraser, running on Windows, cannot access the swap file. The only way
to overwrite the swap file contents (while keeping the virtual memory
enabled in Windows) is to shutdown Windows, boot to DOS and use a DOS
wipe utility, such as EraserD included with Eraser 5.0, to clear the
file.
Alternatively, one can disable the virtual memory on Windows settings,
reboot and overwrite the unused disk space on the drive where the swap
file used to be. After completing the procedure, enable the virtual
memory and reboot. Unlike Windows 9x, NT (and 2000) has a built-in
security feature that causes the operating system to overwrite the
paging file at shutdown; Eraser allows you to enable this feature.
Q: "But I know there are programs that wipe the swap file while
Windows is running!"
A: There are applications that claim to overwrite swap file contents
while Windows is running. They are usually trying to accomplish this
by allocating huge amounts of memory and hoping that the operating
system will write it to the disk (overwriting previous data). Doing
this may even prove to decrease security instead of increasing it -
instead of flushing the memory allocated by the overwriting program to
the swap file, Windows may as well decide to save the memory allocated
by some other application to the disk, possibly causing sensitive data
that otherwise would have remained in the memory to end up on your
drive. And even if the user is real lucky and everything goes as
planned, the data currently allocated in the swap file still cannot
(and will not) be accessed."
Ah, you can disable the swap file and wipe unused disk space. This
will be slow though...
