I have done several tests on the Windows SWAP file, trying to find a way to
clean out all the incriminating info stored there. The results of these tests
have been pretty dismal. The only prog that really cleaned even SOME of this
is Evidence Eliminator, but that was after allowing it to run for an hour and
a half, cleaning and "defragging" the registry, swap file, etc...
Here are the tests I've performed:
1. WindowWasher does NOTHING to the swap file.
2. BCWipe does NOTHING to the swap file.
3. Renaming does NOTHING to the swap file.
4. Rename, FLUSH (an overwrite prog), delete does NOTHING
5. Evidence Eliminator, with every paranoid setting imagineable enabled,
cleaned MOST of the incriminating evidence, but still left enough info to
raise question and warrant further investigation.
That's just a summary of the tests I did over a period of several days. I
used Encase to gather the results. Other tests included moving the swap file
to a seperate partition, and performing all the above tests again.
All tests returned the same results.
In conclusion, I've found there are 2 ways to beat the swap file.
1. Get yourself a SHITLOAD of RAM (a friend o mine uses 160Mb), and DISABLE
your swap file. This is not recommended, but well, if there's no swap file,
it can't contain eveidence (I've only got 64Mb RAM, and can't test this, so
yer on yer own and don come cryin to me if you get busted)
2. Start over with a clean, fresh Windows install...every day. How ? First,
get yerself a partition that's at least as big as you C:\ drive 9or whatever
drive you run Windows from). Next, get yourself a drive imaging program. I
use GHOST, and will refer to it. If you want to use another one, use these
requirements on choosing one:
1. That it can run in DOS.
2. That you can run it from a floppy disk (or CD)
3. That you will be able to add/delete files FROM THE IMAGE. this is
important in order to make it easier to restore.
4. that it can run from a command line (not really required, but makes it
easier)
From here on out, I will tell you how to use/maintain a clean backup image
with GHOST. If you use another prog, yer on yer own, cause chances are I don
know how to use it.
1. Make sure the partition you plan to store the image on is CLEAN. that
means, fresh format, BCWipe the fucker about 5 or 500 times, and make sure
it's clean (if you use a CD, use one right outta the package..safer that way)
2. Make sure the partition is big enough. If it's not, make it so, then goto
step 1.
3. Gather together ALL the programs you want installed when you restore your
system. Make sure you have all the cracks, keys, or whatever you need. Store
them somewhere BESIDES drive C:\
4. Make sure you have a Windows restore CD, or whatever files are necessary
(you'll be starting from scratch here.....)
5. Make a backup image of drive C, and store it on a seperate partition
(It's OK to use compression if you want...this one is just in case you delete
something you wanted to keep)
6. Reboot your computer from a floppy disk, and format drive C. Go ahead and
do a long format of it...you won be needing that data anymore.
7. Re-Install Windows from your restore CD, and set it up with all the
programs you want installed. DO NOT go surfing at this point. Make sure you
fix all the program settings the way you want them, so you don't hafta keep
fixing them.
8. Wipe, defrag, and re-wipe drive C. Do this however many times you think
is necessary, but do it AT LEAST once...the data that existed prior to the
format is still there.
9. Now it's time to go into the GHOST image you created, and gather all the
files you want to keep. DO NOT restore topic files, and don't restore any
.dat files. When you've gotten everything you want, DELETE the image, wipe it
5 or 50 times. Get rid of it...
10. Run GHOST, and create your backup, storing it on the clean partition
you've reserved for this little treasure.
Once the backup is created, surf, play, whatever you want to your hearts
content. remember, it's always a good idea to use WindowWasher, EE ,or
similar, wipe with BCWipe, whatever...do not change your regular security
processes (unless they need improvement).
Each day, when you're done with the pooter, boot into DOS (I use a CD I
created for this purpose), run GHOST, and restore your system from the clean
image. After rebooting wth the clean restore, be sure to run BCWipe and
defrag at least once.
If you decide you want to install a new program, go ahead and do so, but
remember it will not be installed when you restore from the clean image. If
you want to permanently add them to the clean image, you might hafta do a
clean restore, then install the programs/set them up, then re-capture the
image, replacing the old one with the new one. One thing you can do, if the
prog doesn't make a whole lot of changes, is use a registry tracing program
like AdvancedRegistryTracer, and you can save all the registry changes in a
file, copy this file into the restore image, then copy the program files
into the restore image. This is kinda complicated, but actually saves me a
shitload of time (I store my restore image on CD)
This process is a pain in the ass to get started. It took me a full day to
get my clean install set up the way I wanted. but once set up and imaged, it
only takes about 5 minutes to a clean install.
This is the safest way I know of, other than complete "abstinence".
If you have any questions, email me [email protected]
BTW My restore only takes me about 3 minutes, cause I keep my program files
(most) onna seperate partition, so the restore is less than 400Mb
uncompressed. FLUSH can overwrite my entire 2 gig primary partition in 4
minutes (when the fucker works right..gotta lotta bugs !)...so in 7 minutes
I have an absolutely clean drive C if the restore image is on harddrive. If
it's on CD, it takes longer.