Feeds

Clearing swap and hibernation files properly

Two neglected open books

  • alert
  • submit to reddit

Providing a secure and efficient Helpdesk

The reason why I recommend using a swap file with the same initial and maximum size is simple: by default, Windows will allow the file to grow as needed, and this means that data traces will be scattered all over your disk. As the file shrinks, some data will no longer be allocated to pagefile.sys, but it will still be there on your disk. Keeping the swap file a fixed size keeps its data allocated, making it easier to clean. It's also good from a performance point of view, as disk defragmenting lasts longer when you haven't got fragments of pagefile.sys interspersed with other fragments all over the place.

So, what size should you choose? If you are short of RAM, try 1.5 to 2.0 times the amount of RAM you have. But if you've got 1GB or more of RAM, you'll rarely need more than a 1GB swap file on a home system.

Paying for convenience

Alternatively, you can use BCWipe, for which you must pay, which will eliminate the unused portion of the swap file, but not the current data in it. However, it can encrypt the swap file, if you like, so that its data can't be read. Read the help files carefully, and follow the recommendations. I will outline them briefly, but you need to get this right. First, choose a specific size for your swap file as described previously. Next, initialise the BCWipe CryptoSwap utility. Be sure to choose the option "Initialise swap file with random data when Windows starts". Now reboot. Next, do a disk wipe including file slack, disk free space, and the swap file. This will remove any leftover swap-file data traces, leaving only encrypted data in the file.

This utility encrypts and decrypts on the fly, so there is obviously going to be some performance overhead. For that reason, not everyone is going to like this method, but it is far more convenient than the manual method outlined above. You do it once, and from then all you need to wipe are file slack and free space, and of course, individual files as appropriate.

Good news for Tuxers

On a Linux system, the swap file is a disk partition and it can be wiped easily with a free tool that I created called LinuxWipeTools. This is a collection of simple Bash scripts that will allow you to wipe your disk in three modes: the swap partition alone, free space only, or an entire disk. The one you want is called WipeSwap.sh. Launch it from a root shell, and it will automatically detect your swap device, wipe it securely, and re-create it for you. You can run it conveniently in the background while you are using your computer, and there is no need to reboot. You can easily modify it and set it as a cron job, and have a freshly-wiped swap partition every day, if you like, without the slightest bother.

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Hackers thrash Bash Shellshock bug: World races to cover hole
Update your gear now to avoid early attacks hitting the web
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.