configure windows to QUICKLY delete pagefile on shutdown? (NOT wipe)

[7point5]

so I just discovered what may be one of the dumbest design choices ever if this is true: when configuring windows to clear the pagefile on shutdown (by flipping the ClearPageFileAtShutdown value in registry to 1) windows actually overwrites the entire file (with zeroes probably)

so obviously when that file's several gigs then it takes several minutes to shutdown

 

anyone found a way to instead tell windows to simply delete it instead? (like users can do by right-clicking delete with the mouse or typing "del pagefile.sys" in command line)

 

 

 

PS. I wanna delete that damn file on shutdown NOT for security reasons but practicality: so that when backing up with Ghost I don't have to delete it manually (which isn't possible to do in command line outside windows anyway)

 

also I've read that starting windows without previous pagefile seems to slightly improve performance or something, dunno if that's true

[Roberto]

so I just discovered what may be one of the dumbest design choices ever if this is true: when configuring windows to clear the pagefile on shutdown (by flipping the ClearPageFileAtShutdown value in registry to 1) windows actually overwrites the entire file (with zeroes probably)

so obviously when that file's several gigs then it takes several minutes to shutdown

 

What exactly is "one of the dumbest design choices ever" about this? The pagefile contains a snapshot of RAM pages and is a very clear potential source of confidential leaks in a secure environment. If you're in that kind of environment the pagefile should absolutely be wiped instead of just deleted. There's more detail here.

 

also I've read that starting windows without previous pagefile seems to slightly improve performance or something, dunno if that's true

 

Not sure if I can call this untrue or just absolute short-termism at its worse. It might be true in the same way that strapping a jet engine to your car makes it go faster: maybe technically true but still a terrible idea.

 

You could delete pagefile.sys out of band in WinPE or suchlike before taking your image if this is important to you. A new one should be created when the image is booted from.

Edited March 21, 2018 by Roberto

[Fazza]

Can you not use SysPrep to prepare the image - I think there is an option to remove the pagefile in that.

[Roberto]

Can you not use SysPrep to prepare the image - I think there is an option to remove the pagefile in that.

 

Indeed.

[Norphy]

Or use an imaging solution that puts the swap file and hibernate files in as exceptions. ImageX does this.

[7point5]

What exactly is "one of the dumbest design choices ever" about this? The pagefile contains a snapshot of RAM pages and is a very clear potential source of confidential leaks in a secure environment.

PS. I wanna delete that damn file on shutdown NOT for security reasons but practicality

practicality

(though maybe I should've bolded it)

 

besides even the security reason doesn't make that much sense: pagefile exists during the entire time my PC is on, what if someone hacks it then? if security were a real concern then there should be no pagefile at all even while the PC's running

and while we're at it no private data should be stored on the PC either (no mails or cookies or anything). hackers don't need to look into the pagefile to extract private data

 

There's more detail here.

I know:

(by flipping the ClearPageFileAtShutdown value in registry to 1)

my query is whether this can be done quickly (by deleting instead of wiping)

 

anyway mine is a primitive backing solution (Ghost) : it requires that you first boot into some sort of simple command-line OS (which they called DOS) and from there, startup Ghost & backup the OS (you can't backup a running OS from within a running OS apparently since data on the active partition changes constantly so you have to first boot in DOS)

 

and guess what: since windows is on an NTFS drive, it's impossible to access & delete files from within DOS on an NTFS partition (DOS doesn't even see NTFS partitions. if I'm in DOS & I even try to change drive letter to an NTFS partition, DOS will say "abort, retry, fail" or something)

 

so unless anyone knows of a "super DOS" which can actually see NTFS partitions...???

Edited March 21, 2018 by 7point5

[Norphy]

so unless anyone knows of a "super DOS" which can actually see NTFS partitions...???

 

Use Windows PE and ImageX or DISM to take the snapshot instead. This has several advantages:

 

1) Modern solution

2) Free (part of the Windows ADK)

3) File based instead of image based so generates considerably smaller images

4) It puts the swapfile and hibernate file into a list of exceptions, meaning it won't copy them into the image file

5) Uses WindowsPE instead of DOS as an execution environment, meaning you can mount NTFS disks and remove content from them without having to boot into the full Windows OS.

6) You can take differencing images with it so if you use it for backups, you can snapshot changes into the same image file.

 

I believe that more modern versions of Ghost use WindowsPE as well but seriously, don't bother with Ghost any more. Its day is long gone.

[Roberto]

anyway mine is a primitive backing solution (Ghost) : it requires that you first boot into some sort of simple command-line OS (which they called DOS) and from there, startup Ghost & backup the OS (you can't backup a running OS from within a running OS apparently since data on the active partition changes constantly so you have to first boot in DOS)

 

I was trying to resist this but using this for an actual backup (I assumed you were talking about taking an image for imaging) is "one of the dumbest design choices ever". If you must use this kind of imaging tool, Acronis can do it while booted.

 

and guess what: since windows is on an NTFS drive, it's impossible to access & delete files from within DOS on an NTFS partition (DOS doesn't even see NTFS partitions. if I'm in DOS & I even try to change drive letter to an NTFS partition, DOS will say "abort, retry, fail" or something)

 

so unless anyone knows of a "super DOS" which can actually see NTFS partitions...???

 

So... Windows PE, which I already suggested?

[Arthur]

you can't backup a running OS from within a running OS apparently since data on the active partition changes constantly so you have to first boot in DOS

You can with VSS. That's what proper backup programs from Veeam, Acronis and StorageCraft use. This means your backups could be fully automated because you wouldn't need to reboot.

 

Veeam's free backup software also has an option to create recovery media which is useful if you need to do a bare metal restore of your PC.

 

since windows is on an NTFS drive, it's impossible to access & delete files from within DOS on an NTFS partition (DOS doesn't even see NTFS partitions. if I'm in DOS & I even try to change drive letter to an NTFS partition, DOS will say "abort, retry, fail" or something)

Not impossible (see NTFS4DOS et al.), but like @Norphy and @Roberto said above you are far better off using something that can either backup from within Windows itself or is based on Windows PE.

 

Ghost for DOS is seriously ancient! Why is anyone still using this in 2018?

Edited March 21, 2018 by Arthur

[7point5]

but windowsPE + imageX is only file-based right? I read to many incidents about those apps skipping key items that Ghost didn't miss during backup

 

is there any sector-based (ie. reliable) backup solution? (more advanced than Ghost I mean since Ghost is also sector based)

 

Ghost for DOS is seriously ancient! Why is anyone still using this in 2018?

maybe cause file systems havent evolved since then (still NTFS)

 

Ghost has never failed me so far ("if it ain't broke" etc.) but if there's something identical in function to Ghost & more recent then I'm good

Edited March 21, 2018 by 7point5

[Norphy]

In the time that I’ve been using it to take images (8+ years), the only things it’s ever skipped are swap files, hibernate files and certain temporary files. It sometimes can get upset if the disk it’s capturing from is faulty but then, so can Ghost.