TechRepublic|Forums|Security

Security

General discussion

  • Creator
    Topic
  • December 16, 2002 at 2:52 am #2312066

    RAM slack in Windows NT

    Locked

    by ed.english · about 20 years, 9 months ago

    Does SP6a for Windows resolve the RAM slack issue by overwriting memory locations before using them for RAM slack in writing a file to disk? If so, where is it documented that this problem has been resolved?

    Topic is locked This conversation is currently closed to new comments.
  • Creator
    Topic

All Comments

  • Author
    Replies
    • June 1, 2004 at 8:08 am #2735284

      Reply To: RAM slack in Windows NT

      by didikai · about 19 years, 3 months ago

      In reply to RAM slack in Windows NT

      Ed,
      I did a little research on SP6a, and could not find any references to RAM Slack. I know that WIN98SE zeroes out the space in a page. (W95 and earlier does not).

      A little experimentation should answer your question, however.

      There is a forensic tool called X-Ways Forensic, by the developer of WINHEX, that will answer your question. In reality, any hex editor will do so.

      Method

      1. Format a floppy diskette and use your hex editor write 1’s to every bit of the data area (Sector 33). Viewed in WINHEX it will show as FF’s.

      2. Go into Notepad and create a small document. Save it to the floppy.

      3. View sector 33 again with the hex editor.
      If RAM is being overwritten, then the data from the end of the file to the end of the sector is being overwritten in the RAM page. If it is still FF’s then the data is not being overwritten.

      Contact me if you have further questions.

      Regards,

      Crimedog

  • Author
    Replies
Viewing 0 reply threads