I'm working on improving the security of my own system by mitigating the chance sensitive information, (e.g. encryption keys) stored in RAM, are inadvertently written to disk. As of now I know of three common ways this can occur and how they could be mitigated:

  1. The contents of RAM are copied to hiberfil.sys when Windows Hibernates
    • Solution: Disable Windows Hibernation
  2. Some contents of RAM are copied into the swap file.
    • Solution: Encrypt the swap file.
  3. Memory Dumps during Windows Blue-screens.
    • Solution: Disable memory dump file generation

Excluding these (as well as tools specifically designed to dump memory) are there any other reasons RAM could unintentionally be written to disk by the operating system?

I would really appreciate any help I could get!

  • An additional one: If you are running inside a hypervisor, snapshots and paused VM copy RAM to disk. Depending on your hypervisor you may have an option to encrypt these files on disk. – llmora Jan 3 '20 at 22:48
  • Thank you for this additional info! – meci Jan 3 '20 at 22:50

Program crashes save minidumps that contain some parts of the process memory, including thread contexts, some active pages, the stack, etc.

The solution for all of these, though, is to use full-disk encryption (FDE). That way it doesn't matter what data is written to the disk - memory dumps, logs, cached files, etc. - they're all encrypted at rest anyway.

If you've got particularly sensitive operations that must never touch disk, the usual way to go is to have a read-only storage medium and boot from that. Unfortunately, Windows doesn't like that and generally will not boot without a writable root NTFS volume. Instead what you can do is build a machine with sufficient RAM to install Windows to a RAMdisk, perform whatever volatile operations you need to, then unmount the RAMdisk and all the contents are permanently lost. RAMdisk tools can also use AWE to force memory to be marked as physical-only, so it can never be paged out to the swap on the host system. You only need about 48GB of RAM to do this, although 64GB gives you a bit more headroom for mounting a ~32GB volume and running the base OS and guest VM.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.