[neos1]

Tis true, tis true. I agreed with your statements and conclusions earlier in this thread. As I pointed out, only those with felonious intentions and or State's secrets would have a need for such paranoia.

[kurdor]

I was wondering i have done a few hardware upgrades to ram and video card i wish to use the clear page file before shutdown function in the windows registry editor to clear my pagefile of old program data. If i do this will it have any detrimental effects to my system? Is it safe to just turn that function on and restart my system?

[WhitPhil]

Originally Posted by kurdor

I was wondering i have done a few hardware upgrades to ram and video card i wish to use the clear page file before shutdown function in the windows registry editor to clear my pagefile of old program data. If i do this will it have any detrimental effects to my system? Is it safe to just turn that function on and restart my system?

There is no need to "clear" the pagefile after doing hardware upgrades.
Just reboot as instructed.

[kurdor]

wel you see the thing is my pagefile has old software which in the middle of uninstalling had a power surge the uninstall messed up and i now have a pagefille filled up with corrupt data im just saying it doesnt do any harm to do that does it?

[neos1]

I have enabled "Clear Pagefile on shutdown" with no detrimental effects to my system.

[WhitPhil]

Originally Posted by kurdor

wel you see the thing is my pagefile has old software which in the middle of uninstalling had a power surge the uninstall messed up and i now have a pagefille filled up with corrupt data im just saying it doesnt do any harm to do that does it?

The pagefile will not have old software in it as a result of a messed up uninstall.

There are very few reasons to clear the pagefile.

[JohnWill]

Originally Posted by neos1

I have enabled "Clear Pagefile on shutdown" with no detrimental effects to my system.

Except that it takes a lot longer to shutdown.

[neos1]

Originally Posted by JohnWill

Except that it takes a lot longer to shutdown.

I did consider your statement about the length of time it took for system shutdown and so I timed it with and without. There is a discernible difference but not enough for me to give up that "feeling" knowing that the pagefile is a clean. I will probably end up disabling it. But until I run across the facts that say it is detrimental to the system, I'll use the control Microsoft built into the system.


WhitPhil

I'm not sure where TrueCyrpt maintains it's settings, but would lay money that it is registry based and absolutely guaranteed that they are not in the pagefile

I see it in my registry, I'm sure your right about that.
Nothing is written to the harddrive it all stays in RAM. Encryption/decryption on the fly they call it.

WhitPhil
Quote:
Originally Posted by kurdor
wel you see the thing is my pagefile has old software which in the middle of uninstalling had a power surge the uninstall messed up and i now have a pagefille filled up with corrupt data im just saying it doesnt do any harm to do that does it?

The pagefile will not have old software in it as a result of a messed up uninstall.

There are very few reasons to clear the pagefile

Since you say there are very few reasons to clear the pagefile, I am wondering, in your opinion, what those few reasons would be?

[neos1]

# "In Airline's Suit, PC Becomes Legal Pawn, Raising Privacy Issues"
Wall Street Journal (05/24/00) P. A1; McCarthy, Michael J.

Federal courts are increasingly allowing prosecutors to search the hard drives on defendants' home PCs for evidence, but the resulting flood of digital information poses difficult questions about privacy. In one ongoing suit, Northwest Airlines obtained court approval to copy the PC hard drives of about 20 flight attendants and the flight attendants' union for suspected involvement in organizing a sick-out. The searches yielded a huge volume of material, since new technology makes it possible to unearth almost all activities that have ever taken place on a computer, including all the Web pages ever visited, email drafts that were never sent, and deleted files. Two flight attendants whose drives were copied, Ted Reeve and Kevin Griffin, say the searches violated their privacy by forcing them to relinquish possibly thousands of pages that did not pertain to the order. Reeve and Griffin are appealing the computer-search order, saying that files on a PC "may be uniquely private" since they can be retrieved even after they are deleted, unlike paper documents that can be destroyed. Reeve says Northwest is trying to smother the Internet's potential as an organizing tool. The flight attendants accuse Northwest of violating their right to free speech and their privacy rights.
http://www.msnbc.com/news/411560.asp

http://technews.acm.org/articles/200...24w.html#item1

[JohnWill]

And nowhere in that news clip does it even suggest they looked for the documents in the paging file.

[neos1]

Originally Posted by JohnWill

And nowhere in that news clip does it even suggest they looked for the documents in the paging file.

Armor Forensics Products Division
Search For:
New Technologies, Inc. - Leaders in Computer Forensics The World Leader in Computer Forensics
Home | About Us | Clients | Careers | Software | Training | Information | Contact

Home Navigation

Recent Events Recent Events
Upcoming Courses Upcoming Courses

Contact Information
TELEPHONE:

Sales & Technical Support
(800) 852-0300
EMAIL:

info@forensics-intl.com
Technical Support:
support@forensics-intl.com
Information

Windows Swap/Page File Defined

Microsoft Windows-based computer operating systems utilize a special file as a "scratch pad" to write data when additional random access memory is needed. In Windows, Windows 95 and Windows 98, these are called Windows swap files. In Windows NT and Windows 2000 and Windows XP they are called Windows page files but they have essentially the same characteristics as Windows swap files. Windows swap/page files are huge and most computer users are unaware of their existence. The size of these files can range from 100 million bytes over a gigabyte and the potential exists for these huge files to contain remnants of word processing, E-Mail messages, Internet browsing activity, database entries and almost any other work that may have occurred during past Windows work sessions. This situation creates a significant security problem because the potential exists for data to be transparently stored within the Windows swap file without the knowledge of the computer user. This can occur even if the work product was stored on a computer network server. The result is a significant computer security weakness that can be of benefit to the computer forensics specialist. Windows swap files can actually provide the computer forensics specialist with investigative leads that might not otherwise be discovered.

Windows swap files are relied upon by Windows, Windows 95, and Windows 98 to create "virtual memory"; i.e., using a portion of the hard disk drive for memory operations. The storage area is important to the computer forensics specialist for the same reason that file slack and unallocated space are important, i.e., large volumes of data exist for which the computer user likely has no knowledge. Windows swap files can be temporary or permanent, depending on the version of Windows involved and settings selected by the computer user. Permanent swap files are of more interest to a computer forensics specialist because they normally store larger amounts of information for much longer periods of time.

Large permanent swap files can hold vast quantities of data and they should be targeted early in the examination by the computer forensics specialist to identify leads relative to past uses of the subject computer. NTI's NTA Stealth program was originally designed to assist in the identification of E-Commerce related leads in Windows swap files. Since then NTI's NTA Stealth program has been upgraded to identify all Internet-related URLs and E-mail addresses on and entire computer system. NTI's various computer forensic filters, e.g., NTA Stealth, Filter_I, Filter_N, Filter_G, Fnames, GetHTML and GExtract were designed to automatically identify computer investigation leads stored in Windows swap/page files. The identified leads can be used to craft lists of key words and strings of text for use with a computer forensics search tool, e.g., TextSearch Plus and TextSearch NT. Intelligent filtering can identify relevant data types which include, credit card numbers, bank account numbers, domestic and international phone numbers, passwords, English language communications, E-Mail addresses, Internet web addresses, graphics files and file fragments, HTML documents dates. NTI developed this method of identifying leads to help enhance the accuracy of computer forensic text searches in investigations and in computer security risk assessments. The methodology is not limited to Windows swap and Windows page files. It can also be used very effectively with any ambient data sources.

The permanent swap file in Windows 3.1 and some later versions is called 386SPART.PAR and it typically has a system attribute which makes it invisible to standard DOS or Windows programs. The file usually can be found in the root directory of the drive designated in the Virtual Memory dialog box. Another place to look is in the Windows subdirectory or the Windows\System subdirectory.

The permanent swap file in Windows 95 and Windows 98 is called WIN386.SWP. It is also usually located in the root directory of the drive designated in the Virtual Memory dialog box. A permanent swap file will not be found on most computers running Windows 95 or Windows 98. In Windows 95 and Windows 98, the default is usually set for the swap file to be dynamic and it shrinks and expands as necessary. When a dynamic swap file is involved, its file size is reduced to zero and the file's content is released to unallocated storage space. Thus, the contents of the dynamic swap file must be analyzed along with the other data stored in this space. This requires the use of specialized computer forensics software tools like NTI's GetFree software to capture the data stored in unallocated storage space which is normally associated with previously 'deleted' files. As with a static or permanent swap file, the output file created by NTI's GetFree software can be analyzed for leads using intelligent filters, as described above.

In Windows NT/2000/XP, the Windows page file is named PAGEFILE.SYS and such files are treated as permanent (static) swap files. Permanent swap files can be viewed like any other file with software utilities like Norton Commander and/or Norton DiskEdit. The problem is that swap/page files can be very large - 100 million bytes to over 1 billion bytes - and they contain mostly binary information which is not readable. Looking for leads in the swap file by viewing it with normal utilities can be tedious and most likely unfruitful because of the massive volume of data involved. Therefore, it is more productive when specialized tools intelligent tools are used depending upon the nature of the case involved. These techniques and concepts are covered in detail in NTI's popular 5 Day Computer Forensics Course.

Armor Forensics
TEL: 800-852-0300 | 13386 International Parkway, Jacksonville FL 32218 | WEB: http://www.forensics-intl.com
© 2005 - Armor Forensics - All Rights Reserved

[WhitPhil]

Originally Posted by neos1

But until I run across the facts that say it is detrimental to the system

Other than an elongated shutdown, there will be no "detrimental" affects.

Since you say there are very few reasons to clear the pagefile, I am wondering, in your opinion, what those few reasons would be?

If I suspected a corrupted pagefile, I "might" clear it, but I would more likely just delete it.

The only reason to clear the file at shutdown, is if you are paranoic or are running in a security environment, where you have concerns that if the hardrive falls into the wrong hands, that there "may" be information that could be retrieved.

[JohnWill]

I think I've enjoyed myself sufficiently in this thread, it's not going anywhere...

[neos1]

The only reason to clear the file at shutdown, is if you are paranoic or are running in a security environment, where you have concerns that if the hardrive falls into the wrong hands, that there "may" be information that could be retrieved.

We, the people of the United States of America have allowed a criminal to maintain control of the White House - and no one of significance is calling for his impeachment.

A sitting Congress that is all but useless in upholding Constitutional law.

A yes man for an Attorney General who believes there are two groups of U.S. Citizens. Those who enjoy the benefits of the Constitution and those who don't.

A police force that is not held to the same laws as the rest of us.

And an unprecedented number of people that have had their property stolen in the name of
eminent domain, given to the highest bidder.

And if not a government/corporate controlled media, then what is it?

(If) after waking this morning and looking around, one isn't just a little bit "paranoic" then one is either, a small child or belongs to said groups above

But then one would have to put down his four wheeler, jet ski, television, porno, fishing pole, or the sports section and focus on the actual moment to know this.

----------------
I marked this solved some time ago.

[WhitPhil]

Originally Posted by neos1

I marked this solved some time ago.

Then quit asking questions, and I'll quit answering them.

Mods: Please close this thread.