Clear Page File At Shutdown [Archive] - Cyber Tech Help Support Forums

rlprlp

January 20th, 2007, 03:37 AM

I normally have this on. I have read all about it, and understand how it works and what it does. However, I have noticed that I really can restart my PC much faster if it is off. So, I was thinking to myself, when my PC is off; well, it's off. And when I turn it back on, it will only be a matter of time before I re-enter any passwords or other information that I entered the last time I was using my PC. This leads into my question: Does anyone know of any instance where a PC user actually ended up saying "This never would have happened if only I had been clearing my Page File at shutdown..." In other words, is clearing it really more secure? This is a home PC that only my wife and I have access to. Thank you to all who take the time to reply.

oracle128

January 20th, 2007, 05:58 PM

I've never heard of a situation like that, and assume that's because it would only really be a problem where data forensics is concerned (eg. the FBI raids your house looking for data, finds it in the page file as evidence, and the criminal remarks "This never would have happened if only I had been clearing my Page File at shutdown...".

However: 1) Under normal use, the Page File will never in a million years contain any passwords. In almost any application, a password is only in memory for as long as it's needed to authenticate a user, which is a fraction of a second. Any authentication after that is usually done with a check flag, rather than continuously re-comparing the password.
The page file deliberately contains only data which has been in memory for much longer, but hasn't been used recently (normally - background/minimized applications). Any passwords inputted should also be encrypted - if they're not encrypted, neither is the stored password to compare the input to, and you're much worse off then anyway (since it'll be stored in plain text, in non-volatile memory).

2) Clearing the page file doesn't clear it for good. You can recover page file data as easily as any other file - and people likely to be snooping through page file data are going to have data recovery tools. Additionally, these people are going to be targeting something specific, not doing a general search for any passwords for any application that might happen to be in there. Crackers, generally, have little reason for this unless it's something major, like a businesses' financial software. You'd think this would include web browsers, because of the potential for sensitive data (internet banking) - but it doesn't, as this is something very specific. You're really only a target if someone has a reason to attack you specifically. This may include law enforcement agencies.

And apart from that, any application that stores a plain text password in memory over a long period of time, isn't likely to be the sort of application that would contain important sensitive data.

Overall, the page file is only accessible if your computer's physical security has been compromised - or alternatively, it's been seriously compromised via a remote attack. In either case, the page file is not an effective way of gathering sensitive data. My estimation is it's the step an attacker would take immediately before analyzing volatile memory for any traces of data retention. In other words, it's going to be the second last place someone looks for sensitive data. By that time, it's unlikely that such forensic examinations would be required, much less feasible. I don't know of any law enforcement agency that makes a habit of analyzing volatile memory, or its cousin the page file.