J
John Corliss
For quite some time now, I've noticed that the swap file (I'm using
Windows ME) is persistant between Windows sessions. Not sure if this
has always been the case. It seems to me that in Windows 3.11 the swap
file got deleted between sessions, but I could be wrong. Regardless,
since the swap file's purpose is to help the computer manage
multitasking, I don't understand why it should remain unchanged
between sessions (not that there might not be a valid reason for
this.) Still, it seems to me that the thing grows and grows during a
session in direct proportion to the amount of activity I engage in.
Then when I reboot, the file remains the same size it was at the end
of the previous session.
This begs the question, what's being kept within it? It's
impossible to view the contents of the swap file directly, and I can't
delete the thing without using a boot disk. This is in spite of the
fact that I *can* delete index.dat files by running a batch file at
startup. In fact, I've modified that batch file to read the following:
del C:\WINDOWS\win386.swp
del C:\WINDOWS\Cookies\index.dat
del C:\WINDOWS\History\History.IE5\index.dat
del C:\WINDOWS\Tempor~1\Content.IE5\index.dat
but it does no good. The swap file remains untouched because it still
stays the same size from reboot to reboot (hard or hot) in spite of
the batch file.
Last night it occured to me that there is a way to view swap file
contents. What I did was the following:
1. Creat a temporary folder (in my case, c:\_1)
2. Use a Startup Disk floppy to reboot and chose the "simple boot"
option (I hope that's the correct description).
3. Go to the Window folder (while still in the DOS session) and enter
the following command:
copy win386.swp c:\_1\win386.bak
(This made a copy of the swap file in the temporary folder - c:\_1 -
I'd created.) The copying process took a while, because the swap file
is large.
4. Remove the Startup Disk floppy, reboot into Windows
5. Use a file splitter to bust the swap file copy into smaller (10 mb)
chunks for managability.
6. Open some of the chunks in WordPad and VOILA! there's the contents
of that portion of the swap file for viewing. Some of it is encrypted,
but some of it isn't.
I ran out of steam when I realized the sheer volume of material I'd
have to scan, however.
My assertion is this: having the swap file be persistant from session
to session opens an avenue for Microsoft (possibly in conjunction
with, or at the behest of, the United States government) tracing your
every keystroke and keeping that record hidden from you. Then, if you
have a cable connection, downloading that info somewhere just before
your computer shuts down. I know a packet sniffer should reveal this,
but who knows what kind of tricks in the OS code can be pulled to
block that from happening? I don't know if indeed this is what's
happening, but I don't like the possibility at all.
To that end, I have located this program:
http://www.jetico.com/index.htm#/bcwipe3.htm
(BCWipe) which claims the following:
"- Swap file wiping. BCWipe utility has an optional switch for wiping
unused portion of Windows Swap File, where the operating system can
potentially store parts of files, earlier opened by applications."
I would really like to be able to totally delete the swap file between
sessions, so that Windows has to create a new and empty one every
single time I reboot. Does anybody else have anything to suggest?
Windows ME) is persistant between Windows sessions. Not sure if this
has always been the case. It seems to me that in Windows 3.11 the swap
file got deleted between sessions, but I could be wrong. Regardless,
since the swap file's purpose is to help the computer manage
multitasking, I don't understand why it should remain unchanged
between sessions (not that there might not be a valid reason for
this.) Still, it seems to me that the thing grows and grows during a
session in direct proportion to the amount of activity I engage in.
Then when I reboot, the file remains the same size it was at the end
of the previous session.
This begs the question, what's being kept within it? It's
impossible to view the contents of the swap file directly, and I can't
delete the thing without using a boot disk. This is in spite of the
fact that I *can* delete index.dat files by running a batch file at
startup. In fact, I've modified that batch file to read the following:
del C:\WINDOWS\win386.swp
del C:\WINDOWS\Cookies\index.dat
del C:\WINDOWS\History\History.IE5\index.dat
del C:\WINDOWS\Tempor~1\Content.IE5\index.dat
but it does no good. The swap file remains untouched because it still
stays the same size from reboot to reboot (hard or hot) in spite of
the batch file.
Last night it occured to me that there is a way to view swap file
contents. What I did was the following:
1. Creat a temporary folder (in my case, c:\_1)
2. Use a Startup Disk floppy to reboot and chose the "simple boot"
option (I hope that's the correct description).
3. Go to the Window folder (while still in the DOS session) and enter
the following command:
copy win386.swp c:\_1\win386.bak
(This made a copy of the swap file in the temporary folder - c:\_1 -
I'd created.) The copying process took a while, because the swap file
is large.
4. Remove the Startup Disk floppy, reboot into Windows
5. Use a file splitter to bust the swap file copy into smaller (10 mb)
chunks for managability.
6. Open some of the chunks in WordPad and VOILA! there's the contents
of that portion of the swap file for viewing. Some of it is encrypted,
but some of it isn't.
I ran out of steam when I realized the sheer volume of material I'd
have to scan, however.
My assertion is this: having the swap file be persistant from session
to session opens an avenue for Microsoft (possibly in conjunction
with, or at the behest of, the United States government) tracing your
every keystroke and keeping that record hidden from you. Then, if you
have a cable connection, downloading that info somewhere just before
your computer shuts down. I know a packet sniffer should reveal this,
but who knows what kind of tricks in the OS code can be pulled to
block that from happening? I don't know if indeed this is what's
happening, but I don't like the possibility at all.
To that end, I have located this program:
http://www.jetico.com/index.htm#/bcwipe3.htm
(BCWipe) which claims the following:
"- Swap file wiping. BCWipe utility has an optional switch for wiping
unused portion of Windows Swap File, where the operating system can
potentially store parts of files, earlier opened by applications."
I would really like to be able to totally delete the swap file between
sessions, so that Windows has to create a new and empty one every
single time I reboot. Does anybody else have anything to suggest?
)