- It appears most internet evidence is stored in the page file, what is the typical size of the page file and how much data can typically be stored in their in REAL TERMS?
- When I say REAL TERMS, I mean say the default setting in Google Chrome for cache and history and cookies is 50 MB how much of a snapshot of a person's internet browsing would this show? 50MB doesn't sound like much, for an average person would it hold a week, month, year?
- It appears most internet evidence is stored in the page file…
Does it appear so? 😯
… what is the typical size of the page file
Describe a "typical" system, a "typical" Operating System and a "typical" browser….
and how much data can typically be stored in their in REAL TERMS?
A whole lot, but I still wonder what do you think it is the connection between the pagefile with a browser cache, history and cookies (all things that are usually stored NOT in the pagefile).
Do read the answers provided to your previous seemingly related question
http//www.forensicfocus.com/Forums/viewtopic/p=6578403/
more or less they amount to saying that browser cache, history and cookies may be either in RAM or on the HDD, but not in the page file (if not - maybe - in some exceptional cases where there has been page swapping from RAM to pagefile).
jaclaz
- It appears most internet evidence is stored in the page file, what is the typical size of the page file and how much data can typically be stored in their in REAL TERMS?
For a full answer, get a book on operating system design, and study the chapter(s) on memory management. For a particular operating system (Windows, VMS, Unix, etc.) there may books that describe the specifics for that particular operating system. For Windows, try 'Windows Internals', latest edition.
For a shorter answer, you might try Googling. It may help you ask a more precise question.
In the context you have presented (no specific operating system), there is no answer. Typically, the page file size is set by default, and is often but not always related to the size of primary memory, even though there is only a tenuous connection between the two. However, on a particular system, the system administrator may have configured the max size to fit the workload of that particular system.
- When I say REAL TERMS, I mean say the default setting in Google Chrome for cache and history and cookies is 50 MB how much of a snapshot of a person's internet browsing would this show? 50MB doesn't sound like much, for an average person would it hold a week, month, year?
On the particular system you're interested in, check the page file size. That's the size. (Typically. But unless a process is paged out, the data won't end up in the page file. The more primary memory, the lower the probability, everything else assumed to be equal.)
However, a page file only intended to be used while a computer is running. When it is shut down or booted (or rebooted) the page file may very well be reset or wiped for security reasons. Again, check the operating system that is relevant to you. And check the particular system as well – it's not unheard of to place page files on RAM disks for performance reasons, though this is not usually seen on client systems. These usually don't need wiping, they lose contents anyway.
Your final question has nothing to do with page file – it's a question about Chrome. I'll leave that to the Chrome experts.
And check the particular system as well – it's not unheard of to place page files on RAM disks for performance reasons, though this is not usually seen on client systems. These usually don't need wiping, they lose contents anyway.
At the risk of going OT 😯 I need to set on records how at least for Windows NT systems the idea (in the words of Mark Russinovich) is ridiculous.
http//
In a nutshell
if you have enough memory you don't need a pagefile, since some apps (as an example some Adobe software) won't work if you haven't one you may have a very small one (that will never be hit, on hard disk) UNLESS you need it for debugging purposes, in which case it is useful to create on crash a full RAM dump (and of course in this latter case it needs to be larger than the RAM amount on the machine).
jaclaz
A pagefile on a RAM disk?
What if you use a VM and while running, it stores part of it's pagefile in your host memory, which in turn is paged out and stored to your pagefile on your RAM disk?
PAGEFILECEPTION. *head explodes*
A pagefile on a RAM disk?
Not the kind of RAM disk that resides in RAM. The kind of RAM disk that is/was a solid-state device, connects by a SATA (or SAS) interface, and appears to the operating system to be a hard drive, but only contains lots of RAM banks and a simple SATA-to-RAM controller. Very useful for legacy systems that paged a lot and that couldn't easily be upgraded or replaced.
Gigabyte had one about 10 years ago called GC-RAMDISK or i-RAM 2. Fairly small, though – 8 Gb, if I remember.
(Added However, if I think about it, it should be technically possible to run a 'soft' RAM disk on a 32-bit client over PAE. The client OS can only access 4Gb, but if the motherboard supports additional memory, it could be used for RAM disk.)
(Added However, if I think about it, it should be technically possible to run a 'soft' RAM disk on a 32-bit client over PAE. The client OS can only access 4Gb, but if the motherboard supports additional memory, it could be used for RAM disk.)
Rest assured ) , it has also been done alright for years, normally using the freeware Gavotte's RAMdisk, JFYI
http//
http//
or some Commercial tools, and there is also the possibility to use AWE (not PAE) to have IMDISK (through awealloc), though with some limitations due to the specific Windows version
http//
http//
jaclaz