This test is to try and find a way to REALLY wipe the swap file.
"Encase.txt" shows the results after just a simple WindowWasher treatment.
This was performed on the system "as is", except for the wash, and shows
that quite a bit of very old information resides in the swap...things which
I haven't seens in several weeks ! It's possible that this stuff has been
collecting since I first installed this OS.
"Encase2.txt" shows the results after running "FLUSH.EXE" over the swap file.
This is done in DOS, and completely "overwrites" the swap file contents. The
file is subsequently deleted. I also deleted some log files.
"Encase3.txt" will show the results after running "BCWipe" to wipe the
free-space. I will only wipe one pass, but will wipe the file-slacks, swap
file, and free-space, as well as empty directories (tho I really don't
think it'll do any good, since alot of the info that's been found in the
swap would've been there since before I last ran BCWipe....The results were
as I suspected. No apparent changes were made to the swap file. At least,
not in the "incriminating evidence".
"Encase4.txt" will show the results after running "FLUSH", and NOT deleting
the swap file after it has been overwritten...(wonder what Windows is gonna
do then ?). Windows re-wrote the data to the swap file, completely
overwriting the data that was written by FLUSH.
The nature of subsequent tests will be detirmined after examining the results
of the previous tests..
"Encase5.txt" for this test, I have MOVED the swap file to drive D, my slave
drive, and am in the process of wiping the fileslacks/freespace of drive C.
Once that's done, I will defrag drive C, and then again wipe fileslacks/
freespace. This test is being done to further confirm the belief that Windows
is storing the data which is written to the swap file, and re-writes that
data each time the system is booted.
After this, I will run Evidence Eliminator, and once again check the swap
file. (It may take a few times, to figure out how to properly use EE.....)
So far, all the tests have shown that the safest way to keep the system clean
is to start with a clean install, back that install up before doing ANYTHING,
with a program such as Ghost, and format/restore/wipe on a daily basis...
(once the backup is made, this can be done in a matter of about 30 minutes...
give or take.)
Encase6 test: Evidence Eliminator ran, but I sat looking at a screen that
said "Analyzing system registry. This will take about 5 minutes..." for about
an hour and a half......I finally got tired of it, and re-booted the system
(fortunately, I didn't hafta restore the registry, yet....). After running
Encase, I still found incriminating evidence in the swap file. Thing is, EE's
swap file process had already run before I re-booted. So it, to, failed.
Back to the ZAPPER method of cleaning the system. It appears to be faster,
and is certainly more effective.
This concludes my tests on the swap file. No more tests will be performed by
me, for a LONG time, cause I've got better shit to do.