The Swap File and your privacy.

[optikl]

John Corliss wrote:

Modifying the batch file so that it reads:

ATTRIB -h -s C:\WINDOWS\win386.swp"
del C:\WINDOWS\win386.swp
del C:\WINDOWS\Cookies\index.dat
del C:\WINDOWS\History\History.IE5\index.dat
del C:\WINDOWS\Tempor~1\Content.IE5\index.dat

had no effect. The swap file still stays the same larger size from
reboot to reboot.

One would think there'd be a freeware program out there somewhere that
murders the phoenix-like swap file between reboots. 80)>

John, are you sure you haven't used a utility like Norton System Works or
gone in yourself and set your virtual memory minimum and maximum settings to
be identical?

 

[null]

This begs the question, what's being kept within it? It's
impossible to view the contents of the swap file directly,

Hey, I've just the proggy for you, John I just put it up at my web
site as a replacement for LFNTREE. I call it FBROWSER. It also Saves
subdirectory tree structures but much more. You can use it as a
hex/text viewer, and it works in both Windows and DOS. Don't use it in
DOS though unless you've invoked SMARTDRV or it will be very slow
going.

I took a look at my Win ME swap file and became bored very soon

BTW, I also put up a new version of my CLONEXX proggy. I eventually
noticed a bug in the file attributes cloning and fixed it. I've also
speeded up the attributes cloning.

I strongly suggest the use of the WINMEDOS proggy that someone
mentioned in this thread. I find it very useful on my Win ME PC to
boot directly into "pure" DOS. I have a W.BAT file in C:\ which my
wife can use by simply pressing the W key and Enter to get into
Windbloze.


Art
http://www.epix.net/~artnpeg

 

[Max]

On Fri, Dec 12 2003, in alt.comp.freeware,

[snip]

Now here's a little jewel for you:

I actually just a little while ago rebooted using an emergency disk,
then deleted the swap file. I even verified that the file had been
deleted. When I rebooted into Windows, there the damned swap file was
*again* and at the *exact same size it was before I deleted it!*

In addition to that, the same thing is now happening with my index.dat
files.

(long winded curses and expletives against Microsoft deleted from this
location)

There's always Linux. But wait, were you not the one that expressed
so much joy with the knoppix linux cd?. What'ya waiting for,
Christmas?. Get a real linux distro going and forget about raging
against a machine that has far too many sheep following it. XP is
controllable now, but what comes next?. Gates and the smurfs taint
going to backpedal on the WPA, DRM, TCPA, or Pallidium crap. I've
the feeling you already know this

Linux distros generally maintain a swap partition. This partition can
be overwritten at will with such things as /dev/zero /dev/random/
/dev/urandom as often as you like (Further measures can be taken to
ensure even more security). Certain other entities, such as patching
the kernel (Not sure if this is needed nowadays), can provide a
completely encrypted swap partition invisible to the user (AES?).

Bottom line: You'll be in control!. Do what you want, how you want,
and when you want. You can also get the best of both worlds with a
dual-boot setup. Use winblows when you must, linux for everything
else.

Excuse the above advocacy. But I understand W98 is or has been
phased out?. Guess wME is next eh?. Choices? What choices? How many
M$ hoops will you jump thru?

BTW - I doubt this is the cause, but have you checked to make sure
ME is using RAM before it uses the swap file? Other then that, what
crap do you have running that might want to keep your previous
swapfile intact?. In my winME days, I never had nor saw this kind of
behavior under ME at all.

Max

 

[Henry George]

To that end, I have located this program:

http://www.jetico.com/index.htm#/bcwipe3.htm

I use Mutilate Swapfile Wiper http://home.att.net/~craigchr/ie4.html
Let me know what you think of it.

 

[Henry George]

On Fri, 12 Dec 2003 05:04:45 -0800, John Corliss
=====Installing Mutilate Swapfile Wiper =====

http://home.att.net/~craigchr/ie4.html

I used notepad to make a file called ripswap.bat.( You can give it
any name you want.)

2. I copied:

C:\Windows\mutwipe.exe C:\Windows\win386.swp /n
Exit

to ripswap.bat and saved it.

3. I moved MutWipe.exe and ripswap.bat to the C:/windows file.

4. I went to Start\Shut Down\Restart in MS-DOS Mode\pushed OK

At the C:\WINDOWS I typed "ripswap" The program erased the swap file
and reinstalled Windows.

 

[Steven Burn]

There is an easier way to run the .bat file.........

Locate your autoexec.bat file and place the path to the .bat file at the
beginning of the file (but after the @echoooff line)

If you don't have an autoexec.bat file, place a key for it in the following
registry key;

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

RunServices get's loaded before Windows does all it's stuff, so it should be
early enough to run the .bat file and get shot of the win386.swp file.

--

Regards

Steven Burn
Ur I.T. Mate Group
www.it-mate.co.uk

Keeping it FREE!

Disclaimer:
I know I'm probably wrong, I just like taking part ;o)

 

[Onno Tasler]

Deleting the swap_file_ won't give you much extra security,
whatever was in the file will still remain on disk until overwritten.

Well, because Windows creates a new swap-file after you deleted the old
one, it is automatically overwritten, isn't it?

Also, Windows always creates a swap file of a certain size, except it is
explicitly told otherwise.

bye,

Onno

 

[Terry Russell]

Well, because Windows creates a new swap-file after you deleted the old
one, it is automatically overwritten, isn't it?

Odds are against all the old swapfile being overwritten by the new swapfile.

Also, Windows always creates a swap file of a certain size, except it is
explicitly told otherwise.

Windows also stores a lot of things that aren't all in the swapfile.

Hey, I can listen to encrypted digital phone transmissions on my TV and
tune it
to display a bad picture from a monitor, _something_is leaking things it
shouldn't.

Now a real paranoid would realise THEY own the phone, disk , RAM and monitor
manufactories . Say cheese.

;-)

 

[REMbranded]

Previous post:

I understand the mechanics of overwriting the file, it'll just add to the
boot time. Can't write 40 or 50 megs that quickly, but I haven't actually
clocked it, so it might not be that big a deal. Just one question though,
why close the file and re-open it after you write every block? Why not just
write to it until you reach the file length you found when you opened it,
then close and delete? I'm probably missing something here.

Oh, no. open and close after each complete file write. Sorry, I must
have worded that badly.

As to the extra write, this comes from watching BcWipe. For each wipe
the swap file size increases about 5 megs. But this is in Windows
mode. Your utility is in DOS mode, so that isn't necessary.

I've uploaded the latest version, it does overwrite the swap file, but like
I said, it takes a while to write like 50megs.

It looks like a great start! I think I gave bum advise as to character
writing using random seed. This is pretty slow. My swap was 83 megs in
Windows, but when I booted to DOS mode it was 209 megs!

The character approach is fine for 10 meg files, but it didn't work
well on the 209 meg file. It took 35 minutes. How many complete writes
were made?

Perhaps a better approach is to just write words, 0xffff and 0x0000
alternating. For this purpose, I wouldn't think security is much more
than peace of mind. You might allow the user to elect more writes
though.

This will remove the random seed overhead and write 16 bits per write,
rather than 8. Much faster!

I'm not certain what has the swap file locked. It has an archive
attribute. The other GUI wipers can wipe the swap, so it's a matter of
figuring out how to get write access to it to work in 32 bit mode.
Then you could write 32 bits per write, 0xffffffff and 0x00000000 and
it would be really fast.

I'll browse around and see if I can find any info.

You have the makings of a very nice utility going here Harold.

 

[John Corliss]

John Corliss wrote:

[snip]

Now here's a little jewel for you:
I actually just a little while ago rebooted using an emergency disk,
then deleted the swap file. I even verified that the file had been
deleted. When I rebooted into Windows, there the damned swap file was
*again* and at the *exact same size it was before I deleted it!*
In addition to that, the same thing is now happening with my index.dat
files.
(long winded curses and expletives against Microsoft deleted from this
location)

There's always Linux. But wait, were you not the one that expressed
so much joy with the knoppix linux cd?. What'ya waiting for,
Christmas?.

The one thing I noticed about the Knoppix distro was that the driver
for my Sound Blaster Audigy X-Gamer card didn't work. I'm sure the
problem can be fixed somehow, but installing Linux on my system will
first require me to partition my hard drive somehow hopefully without
having to format it (probably I'll use Ranish
http://www.ranish.com/part/, if it supports that feature but I don't
know if it does), and also I'll need to locate drivers for all my
legacy peripherals. I know it's possible, but right now I'm busy
working on kitchen cabinets and with the holiday season.

Get a real linux distro going and forget about raging
against a machine that has far too many sheep following it.

Heh. Wish I could simply dump Windows and migrate, but as you probably
know it's not that simple. I'll need to keep Windows working during
the process somehow.

XP is
controllable now, but what comes next?. Gates and the smurfs taint
going to backpedal on the WPA, DRM, TCPA, or Pallidium crap. I've
the feeling you already know this

Yep. WPA and the screwed up drivers for legacy equipment that come
with XP are why I opted for ME instead of XP when I bought this
computer. If the company I bought the computer from had still been
offering W98SE, I would have gone for that instead.

Linux distros generally maintain a swap partition. This partition can
be overwritten at will with such things as /dev/zero /dev/random/
/dev/urandom as often as you like (Further measures can be taken to
ensure even more security). Certain other entities, such as patching
the kernel (Not sure if this is needed nowadays), can provide a
completely encrypted swap partition invisible to the user (AES?).
Bottom line: You'll be in control!. Do what you want, how you want,
and when you want. You can also get the best of both worlds with a
dual-boot setup. Use winblows when you must, linux for everything
else.

Excuse the above advocacy. But I understand W98 is or has been
phased out?. Guess wME is next eh?. Choices? What choices? How many
M$ hoops will you jump thru?

Not many or any more if I can help it.

BTW - I doubt this is the cause, but have you checked to make sure
ME is using RAM before it uses the swap file?

Not sure how I would go about doing that. Sounds like a great idea though.

Other then that, what
crap do you have running that might want to keep your previous
swapfile intact?.

Don't know. AV or firewall perhaps?

In my winME days, I never had nor saw this kind of
behavior under ME at all.

Well now, that is indeed interesting. I thought that it was just
normal behavior for the OS.

 

[John Corliss]

John, are you sure you haven't used a utility like Norton System Works

*SHUDDER* Perish the thought. Don't even have a copy of it or anything
like it.

or gone in yourself and set your virtual memory minimum and maximum
settings to be identical?

Absolutely sure. Current setting (just checked) is "Let Windows manage
my virtual memory settings. (Recommended)" and always has been.
Besides, setting a fixed size won't remove the problem of the swap
file containing sensitive information, it'll just have less of it. I
want the swap file to be created fresh every time I reboot.

Somebody said that Windows isolates the swap file so that no program
can access it, but I say that anything can be hacked. Hell, I sorta
did it so how hard can it be?

 

[John Corliss]

John,
Let us know how things work out. It's an interesting issue.

Unfortunately, using the SwapFileOverwriter/scorch combo method would
slow down boot time too much. What I want to do is to simply delete
the swap file and have it recreated every time I reboot. I've noticed
no boot time delay on those occasions when I've successfully deleted
the swap file and the system recreates a fresh one.

On the other hand, Max (if I understand him correctly) has said in
another reply to this thread that when he was using ME he never saw
such behavior as I'm experiencing (swap file being restored to
previous size after having deleting it.)

 

[John Corliss]

Repeat after me: ' Admit nothing, I was drunk at the time, the goat is
lying' ;-)

"Honest officer! I was just trying to help that sheep over the fence."

 

[Steve H]

Somebody said that Windows isolates the swap file so that no program
can access it, but I say that anything can be hacked. Hell, I sorta
did it so how hard can it be?

Indeed it can - Norton Utilities contains just such a utility

Regards,

 

[John Corliss]

Hey, I've just the proggy for you, John I just put it up at my web
site as a replacement for LFNTREE. I call it FBROWSER. It also Saves
subdirectory tree structures but much more. You can use it as a
hex/text viewer, and it works in both Windows and DOS. Don't use it in
DOS though unless you've invoked SMARTDRV or it will be very slow
going.

Heh. With a swap file that averages 130 - 200 mb, it's kinda
impractical to view it anyhow.

I took a look at my Win ME swap file and became bored very soon

My experience exactly.

BTW, I also put up a new version of my CLONEXX proggy. I eventually
noticed a bug in the file attributes cloning and fixed it. I've also
speeded up the attributes cloning.

I strongly suggest the use of the WINMEDOS proggy that someone
mentioned in this thread. I find it very useful on my Win ME PC to
boot directly into "pure" DOS. I have a W.BAT file in C:\ which my
wife can use by simply pressing the W key and Enter to get into
Windbloze.

There's another one here:

http://www.overclockers.com.au/techstuff/a_dos_me/

I've considered these program but it seems to me that there was some
kind of trade off in that you can't view certain types of (hh.exe)
help files.

 

[REMbranded]

Somebody said that Windows isolates the swap file so that no program
can access it, but I say that anything can be hacked. Hell, I sorta
did it so how hard can it be?

It is locked, but BcWipe (and probably Eraser) will wipe them silly.
It's a matter of figuring out how to unlock the file, do the work and
lock it again.

 

[John Corliss]

There is an easier way to run the .bat file.........

Locate your autoexec.bat file and place the path to the .bat file at the
beginning of the file (but after the @echoooff line)

In ME the autoexec.bat file can only be modified (for the most part
and with great difficulty) using the System Configuration utility.
There is no "@echoooff" line in the autoexec.bat file on my system.

If you don't have an autoexec.bat file, place a key for it in the following
registry key;

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

RunServices get's loaded before Windows does all it's stuff, so it should be
early enough to run the .bat file and get shot of the win386.swp file.

This is clearly explained by Microsoft through this ludicrously
overlong link:

http://support.microsoft.com/defaul...port/kb/articles/Q179/3/65.ASP&NoWebContent=1

or through this shortened link:

http://makeashorterlink.com/?D21812CC6

Much better idea. I'll give it a try.

 

[Kevin Pittman]

SNIP>

Hi John, Hope this comes out OK as I've just started using XNews and
hope I've got it set up right.

What I did John was firstly to set the swap file up for a fixed size
-
the value of that is that I know where stuff is being put. Secondly
I
installed Eraser. Thirdly, I set up the AUTOEXEC batch file as below
(for which I have to thank Wasup for much of the basic idea) - you'll
see that normally it just boots straight up or alternatively I can
clear
up everything bar the swap file or alternatively I can even clean up
the
swap file. The only difficulty I should mention is that if you set
the
swap file size large (which is good to reduce paging in and out) it
takes quite a while to "erase". Hope this idea helps.

Regards

Kevin

cls

choice /T:n,10 /C:fpn Choose F - full cleanup, P - partial cleanup,
N
- no cleanup:

if errorlevel 3 goto noclean
if errorlevel 2 goto partclean
if errorlevel 1 goto fullclean


:fullclean
if exist %winbootdir%\smartdrv.exe %winbootdir%\smartdrv.exe 2048 16
cd c:\progra~1\eraser
eraserd -file c:\windows\cookies\index.dat -passes 7
eraserd -folder c:\windows\cookies -subfolders -passes 7
eraserd -file c:\windows\history\index.dat -passes 7
eraserd -folder c:\windows\history -subfolders -passes 7
eraserd -folder c:\windows\recent -subfolders -passes 7
eraserd -folder c:\windows\temp -subfolders -keepfolder -passes 7
eraserd -folder c:\windows\tempor~1 -subfolders -passes 7
deltree /Y c:\windows\tempor~1\
deltree /Y c:\windows\cookies\
deltree /Y c:\windows\history\
eraserd -file c:\WIN386.swp -passes 3
scanreg /fix
scanreg /opt
goto end

artclean
if exist %winbootdir%\smartdrv.exe %winbootdir%\smartdrv.exe 2048 16
cd c:\progra~1\eraser
eraserd -file c:\windows\cookies\index.dat -passes 7
eraserd -folder c:\windows\cookies -subfolders -passes 7
eraserd -file c:\windows\history\index.dat -passes 7
eraserd -folder c:\windows\history -subfolders -passes 7
eraserd -folder c:\windows\recent -subfolders -passes 7
eraserd -folder c:\windows\temp -subfolders -keepfolder -passes 7
eraserd -folder c:\windows\tempor~1 -subfolders -passes 7
deltree /Y c:\windows\tempor~1\
deltree /Y c:\windows\cookies\
deltree /Y c:\windows\history\
goto end


:noclean
cls
goto end

:end
echo off
cls
SET COMSPEC=C:\WINDOWS\COMMAND.COM
SET windir=C:\WINDOWS
SET winbootdir=C:\WINDOWS
SET PATH=C:\WINDOWS;C:\WINDOWS\COMMAND
SET PROMPT=$p$g
SET TEMP=C:\windows\TEMP
SET TMP=c:\windows\TEMP
win

 

[null]

There's another one here:

http://www.overclockers.com.au/techstuff/a_dos_me/

I've considered these program but it seems to me that there was some
kind of trade off in that you can't view certain types of (hh.exe)
help files.

I don't think you're seeing or appreciating the value of being able to
boot into "pure" DOS on a Win ME PC without having to use a system
boot disk. Oh well.


Art
http://www.epix.net/~artnpeg

 

[null]

In ME the autoexec.bat file can only be modified (for the most part
and with great difficulty) using the System Configuration utility.
There is no "@echoooff" line in the autoexec.bat file on my system.

You can edit the autoexec.bat file in any text editor.


Art
http://www.epix.net/~artnpeg