Clear the page file to prevent data leaks

Virtual memory is a truly great mechanism. It protects programs from one another and lets them utilize more memory than actually available. In a nutshell, you can think of virtual memory as an alternate set of memory addresses.

As you run more and more programs, at some point, you’ll begin running out of physical memory. Since things can get slower when this happens, the virtual memory manager will copy as much data and possible into main memory and leave the rest on the disk (the page file). This process is known as swapping.

If you run a program that contains confidential information (passwords, encryption keys etc.), the memory chunk containing such information may be swapped out to disk. Windows deploys several types of protection mechanisms to assure no one is trying to read the page file, but what happens when you boot into a different operating system? Your confidential data is exposed to prying eyes.

To prevent potential information leaks, you can configure Windows to overwrite the page file each time it shuts down. To enable this option, open the Windows Registry editor (Run and type regedit) and navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management and change the value of ClearPageFileAtShutdown to 1.

windows-pagefile.jpg

Now, the next time you shut down your computer, the page file will be cleared. Note that it may take Windows longer to shut down.


Comments

It doesn’t scrud the data.. It only clears the entry. You need to use Eraser or something like that to over-write if you want to be REALLY secure…

Post a Comment



Security-Hacks is a web site that covers tips and tricks for security. Updated several times daily, Security-Hacks points out tools downloads, how-to's and tutorials.

Contact


Have a hot hack? want to request a hack? let us know - editor [at] security-hacks.com

subscribe

Enter your Email

Archives

Add to Technorati Favorites