Virtual memory

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

A basic question about virtual memory in windows Xp home edition. Does the virtual memory (pagefile.sys) get overwritten on shutdown as I believe it does in Windows 2000 and NT (but not ME). Thank you for your help. I have tried to find the answer in FAQ and other sousrces without success.
 
Hi

How do you mean 'overwritten'? The Pagefile can be cleared at shutdown. See if the following article by MVP Alex Nichol helps you:

"Virtual Memory in Windows XP"
http://aumha.org/win5/a/xpvm.php

--

Will Denny
MS-MVP Windows - Shell/User


| A basic question about virtual memory in windows Xp home edition. Does the virtual memory (pagefile.sys) get overwritten on shutdown as I believe it does in Windows 2000 and NT (but not ME). Thank you for your help. I have tried to find the answer in FAQ and other sousrces without success.
 
Thanks for the help the article by Alex Nichol is informative. What I meant by overwritten was that I understood if the pagefile is not overwritten on shutdown a security vulnerability exists in that passwords and other secure information may be retained in the 'virtual memory' on shutdown and hence vulnerable. I note that you advise that the pagefile can be cleared at shutdown do you know if this is automatic or not or do I need to set something up. Again thanks for your help and very quick response - greatly look forward to hearing from you again. Best regards
 
Hi

Yes, you are correct. Various information is kept in the Pagefile, unless it is cleared at shutdown. This takes extra time for the shutdown, but I have that option enabled.

It is not automatic and can be enabled by using gpedit.msc - Computer Configuration>Windows Settings>Security Settings>local Policies - expand Security Options. Double-click 'Shutdown: Clear virtual memory pagefile'. Click 'Enabled' and then OK.

--

Will Denny
MS-MVP Windows - Shell/User


| Thanks for the help the article by Alex Nichol is informative. What I meant by overwritten was that I understood if the pagefile is not overwritten on shutdown a security vulnerability exists in that passwords and other secure information may be retained in the 'virtual memory' on shutdown and hence vulnerable. I note that you advise that the pagefile can be cleared at shutdown do you know if this is automatic or not or do I need to set something up. Again thanks for your help and very quick response - greatly look forward to hearing from you again. Best regards
 
One up to you Joan, thanks. Yes gpedit.msc is only available with XP Pro, although there is a manual Registry edit for XP Home:

Navigate to the following key in the Registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management (ClearPageFileAtShutdown)

and double-click on ClearPageFileAtShutdown in the right hand pane. Set the value to 1 to enable and to 0 to disable.

--

Will Denny
MS-MVP Windows - Shell/User


| Hi Will
| Don't I remember you saying that was only available if you had XP Pro.
| Joan
|
| Will Denny wrote:
| > Hi
| >
| > Yes, you are correct. Various information is kept in the Pagefile,
| > unless it is cleared at shutdown. This takes extra time for the
| > shutdown, but I have that option enabled.
| >
| > It is not automatic and can be enabled by using gpedit.msc - Computer
| > Configuration>Windows Settings>Security Settings>local Policies -
| > expand Security Options. Double-click 'Shutdown: Clear virtual
| > memory pagefile'. Click 'Enabled' and then OK.
|
|
 
If you have XP Home Edition you can get an excellent program that not only will allow you to overwrite the pagefile with 0's at shutdown but will speed your machine up overall. SpeedXP is it's name. Having said that. The pagefile is unloaded and reloaded at every shutdown and reboot so the same info contained in it will be overwritten time and time again. If that weren't the case your system would soon be clogged up with the biggest pagefile the world has ever seen. I do not recommend the "clear pagefile at shutdown option" unless you happen to be someone who has secrets you don' want anyone in the world to know. As I said "clear pagefile at shutdown" options literally overwrite the pagefile with 0's before clearing it. This can add literally minutes to your shutdown and is only good for the present pagefile and must be done upon each and every shutdown. For stand alone home computers this is a bit extreme and there certainly are other ways to get at the info on your OS without using the security exploit of information in the pagefile. An individual may have to access the pagefile at bootup and do this dozens of times to find what he or she is looking for as the pagefile will contain different information every time you use the computer. Highly unlikeley if you are present at every boot and if you setup your machine to have a BIOS password and an OS password then cracking those will take a lot of time. If on the other hand you have government top secret documents or codes or info then you may want to enable the "clear pagefile at shutdown" . Have fun. {:~)
 
Hi
I went to the Registry, (somewhat nerviously) and followed your clear instructions and found that the value of the ClearPageFileAtShutdown was already set at 1 so I assume that the pagefile.sys is cleared on shutdown I guess that must be the default setting on my machine as I have never ventured into the esoteric realms of the Registry before
Thank you all for your help, if my assumptions are wrong please let me know.
 
Hi

Sorry - I didn't post my normal warning about manually editing the Registry - my fault.

If that key is set to 1, then yes, the Pagefile is cleared at shutdown. I thought that the default value was 0. I'll have to clean install XP to find out.

Thanks for your help.

--

Will Denny
MS-MVP Windows - Shell/User


| Hi,
| I went to the Registry, (somewhat nerviously) and followed your clear instructions and found that the value of the ClearPageFileAtShutdown was already set at 1 so I assume that the pagefile.sys is cleared on shutdown I guess that must be the default setting on my machine as I have never ventured into the esoteric realms of the Registry before.
| Thank you all for your help, if my assumptions are wrong please let me know.
 
Will Denny said:
Hi

Yes, you are correct. Various information is kept in the Pagefile, unless it is cleared at shutdown. This takes extra time for the shutdown, but I have that option enabled.
Click to expand...

I have never repeat never heard of an authenticated instance where
usable information was recovered from the contents of the swap file in
any version of Windows.

If there is documented evidence of such an occurrence then I would
appreciate a link or other reference to it.

Thanks.


Ron Martell Duncan B.C. Canada
--
Microsoft MVP
On-Line Help Computer Service
http://onlinehelp.bc.ca

"The reason computer chips are so small is computers don't eat much."
 
Ahh.. The magic of paragraphs and newsreader format rules. SpeedXP looks
rather interesting after I took the time to decipher the post.
This is what it could look like with some white space. 8-)
The Unknown P wrote:


If you have XP Home Edition you can get an excellent program that not
only will allow you to overwrite the pagefile with 0's at shutdown
but will speed your machine up overall.

SpeedXP is it's name.

Having said that. The pagefile is unloaded and reloaded at every shutdown
and reboot so the same info contained in it will be overwritten time
and time again. If that weren't the case your system would soon be
clogged up with the biggest pagefile the world has ever seen. I do
not recommend the "clear pagefile at shutdown option" unless you
happen to be someone who has secrets you don' want anyone in the
world to know.

As I said "clear pagefile at shutdown" options
literally overwrite the pagefile with 0's before clearing it. This
can add literally minutes to your shutdown and is only good for the
present pagefile and must be done upon each and every shutdown. For
stand alone home computers this is a bit extreme and there certainly
are other ways to get at the info on your OS without using the
security exploit of information in the pagefile.

An individual may have to access the pagefile at bootup and do this dozens
of times to find what he or she is looking for as the pagefile will contain
different information every time you use the computer. Highly
unlikely if you are present at every boot and if you setup your
machine to have a BIOS password and an OS password then cracking
those will take a lot of time. If on the other hand you have
government top secret documents or codes or info then you may want to
enable the "clear pagefile at shutdown" .

Have fun. {:~)

Reposted in a readable format.
--

Michael Stevens MS-MVP XP
(e-mail address removed)
http://michaelstevenstech.com
For a better newsgroup experience. Setup a newsreader.
http://michaelstevenstech.com/outlookexpressnewreader.htm
 
Back
Top