Thread: Preventing data theft from the swap file

Preventing data theft from the swap file. The swapfile might contain confidential information, but it continues to store data even after the PC has been shut down. Although this data is not easily accessible, hackers are equipped with tools like 'Poolfinder', which help them read this data. If your notebook which is often traveling with you is lost or stolen, the risk is huge.

Make sure that Windows destroys the swap data while shutting down. This is especially easy in XP Professional and Vista Ultimate Edition, but you must tweak the registry manually in the Home versions. Open 'Start I Control Panel' and click on 'Performance and Maintenance' and then on 'Administrative Tools'. In the Control Panel classic view, you can directly reach this window by double-clicking on 'Administrative Tools'. Then open the 'Local Security Policy' by double-clicking on it.
In the left pane tree structure, navigate to 'Security Settings I Local Policies I Security Options'. In the right pane, double-click on the policy. 'Shutdown Clear virtual memory pagefile'. In the following dialog, select 'Activated' and confirm with 'OK'. In Vista Ultimate, this dialog shows an additional tab that explains the policy. In XP Home and Vista Home, you have to log on with administrator rights. In Windows XP, open the registry editor with 'Start I Run ...', 'regedit.exe' and a click on 'OK'. In the tree structure of the editor navigate to the key 'HKEY_LOCAL_ MACHINE\ SYST E M\C u rrentControl Set\Control\ Session Manager\Memory Management'. The right side will display the value 'Clear-PageFileAtShutdown'. Open it by double-clicking on it. In the 'Edit DWORD Value' dialog, set the 'Value data' field to '1' and confirm with 'OK'. After restarting the system, Windows will henceforth overwrite the contents of the swap file 'Pagefile.sys' when shutting down, with an exception of a reserved area for organization and administration. Depending on the file size and system performance, the shut down takes a few seconds longer.