Pagefile.sys
Virtual memory file that extends physical RAM and contains sensitive data from running applications.
Security Risks
- • Stores memory pages when physical RAM is full
- • Contains passwords, encryption keys, and personal information
- • Persists across system reboots by default
Commands
# Disable pagefile wmic computersystem set AutomaticManagedPagefile=False # Clear pagefile on shutdown reg add "HKLMSYSTEMCurrentControlSetControlSession ManagerMemory Management" /v ClearPageFileAtShutdown /t REG_DWORD /d 1
Hiberfil.sys
Hibernation file containing complete memory dump with full system memory snapshot.
Security Implications
- • Full system memory snapshot including sensitive data
- • Encryption keys, passwords, and application data
- • Larger than physical RAM size (75% of RAM)
- • Accessible to forensic analysis tools
PowerShell Commands
# Disable hibernation powercfg /hibernate off # Verify hibernation status powercfg /availablesleepstates