When dealing with encryption tools (TrueCrypt, Bitlocker and any successors) the passwords are always somewhere in memory. Therefore when there are memory dumps on a hard disk, for example in the pagefile.sys, these passwords remain after a PC crash or abrupt shut down (like for example when someone will steal the computer). These can be retrievable by anyone who reads the hard disk.

To prevent something like this from happening with the pagefile.sys you can activate a Windows registry entry and Windows will encrypt the pagefile.sys with a random key which is generated on boot.

Now my question is how is Hyper-V handling this? Hyper-V seems to save the memory of its guest VMs continuously on the hard drive and you can even pause the VMs or create snapshots of powered on VMs where of course the memory also has to be included.

Are these Hyper-V memory dumps encrypted, and if not is there a way to activate such an encryption? Or is the only feasible way to protect virtual memory against i.e. theft of the host computer to keep all Hyper-V configuration and virtual disk files on encrypted volumes of the host machine?

(In these scenarios I always assume that in the VMs any sort of full disk encryption is running)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.