Feeds

Clearing swap and hibernation files properly

Two neglected open books

  • alert
  • submit to reddit

Remote control for virtualized desktops

Privacy workshop Most privacy-conscious users are familiar with deleting files securely, that is, destructively with overwriting and with wiping free space on their disks. But two items that often get overlooked are the swap file (or swap partition), and the hibernation file.

Let's start with the swap file. This is an area of your hard disk where data previously held in RAM is written, and later read, to "free up" physical memory and make it available for other tasks. Data swapped from RAM to disk is sometimes called "virtual memory". Your computer can read from RAM much faster than it can read from the disk, but RAM is expensive, whereas disk space is comparatively cheap and usually plentiful. Thus, it's not unusual for a system to have a swap file of 1GB or more.

Unfortunately, your swap file knows a lot about you. Pretty much anything you do with your computer can leave traces there. Files you've opened and their contents, websites you've visited, online chats you've had, emails you've sent and received, virtually anything can end up archived in it for quite a long time - months, and even years. You can delete, even wipe securely, the original data, and still your swap file might tell on you by retaining duplicate traces of your computing behaviour. Forensics practitioners consider the swap file to be a real bonanza of data traces, because swapping is an automatic, background process that users - even privacy-conscious ones - can't control completely.

So, what data gets swapped to disk? No one can say: it depends on conditions and memory needs peculiar to each system. Not all data is swapped to disk, but virtually any data might be swapped - even passwords, potentially.

In fact, it's possible that the plain text versions of encrypted files could turn up in the swap file: perhaps the content was swapped to disk before encrypting or after decrypting - that is, when a user is viewing or editing the plain-text content of these files. A good encryption utility will have its own viewer and editor designed to prevent swapping the plain-text data. But are you certain that it works as it should? And what happens if you copy and paste between two decrypted files, or between two files that you intend to encrypt later? Clipboard contents can certainly be swapped.

So, what are the solutions? First, and most obviously, don't use a swap file or swap device. If you've got plenty of RAM, you might not need anything more. Some Windows applications, games, etc, require a swap file even when there is an abundance of RAM, so not everyone can use this option. But Linux users can almost always get away with not using a swap partition if they have plenty of RAM, say 1GB or more.

The next approach is to perform a manual, secure wipe of the swap file on a regular schedule with the help of an inexpensive utility like BCWipe for Windows users, or a free utility like LinuxWipeTools for Tuxers.

Internet Security Threat Report 2014

More from The Register

next story
Webcam hacker pervs in MASS HOME INVASION
You thought you were all alone? Nope – change your password, says ICO
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Meet OneRNG: a fully-open entropy generator for a paranoid age
Kiwis to seek random investors for crowd-funded randomiser
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Reducing the cost and complexity of web vulnerability management
How using vulnerability assessments to identify exploitable weaknesses and take corrective action can reduce the risk of hackers finding your site and attacking it.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.