Security

Ask something
Discussion Locked

RAM slack in Windows NT

0 helpful
1 reply

by ed.english

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Does SP6a for Windows resolve the RAM slack issue by overwriting memory locations before using them for RAM slack in writing a file to disk? If so, where is it documented that this problem has been resolved?

1 reply

by didikai

Ed,
I did a little research on SP6a, and could not find any references to RAM Slack. I know that WIN98SE zeroes out the space in a page. (W95 and earlier does not).

A little experimentation should answer your question, however.

There is a forensic tool called X-Ways Forensic, by the developer of WINHEX, that will answer your question. In reality, any hex editor will do so.

Method

1. Format a floppy diskette and use your hex editor write 1's to every bit of the data area (Sector 33). Viewed in WINHEX it will show as FF's.

2. Go into Notepad and create a small document. Save it to the floppy.

3. View sector 33 again with the hex editor.
If RAM is being overwritten, then the data from the end of the file to the end of the sector is being overwritten in the RAM page. If it is still FF's then the data is not being overwritten.

Contact me if you have further questions.

Regards,

Crimedog

This discussion is closed to new replies.