- C:
- pagefile.sys
FileRisk: Caution
- Hidden
pagefile.sys C:\pagefile.sys
pagefile.sys: the paging file (virtual memory). Windows moves RAM pages into it and uses it to write a memory dump after a crash.
What it’s for
pagefile.sys is the paging file. When RAM runs short, Windows moves pages into it, which extends the virtual memory available. It is also where a memory dump is written after a system crash, which is a good reason to keep it even on a machine with plenty of RAM.
What it contains
- Memory pages pushed out of RAM, so possibly sensitive data: passwords, keys, open documents.
- By default Windows manages the size itself according to memory and usage. You can also set it by hand.
- For a complete memory dump, the paging file must sit on a local volume and be at least as large as RAM plus 257 MB. A small (64 KB) dump needs at least 2 MB on the boot volume.
Risks and best practices
- The system keeps it locked, so there is no point deleting it by hand. To shrink it, move it or fix its size, go to Advanced System Settings > Performance > Advanced > Virtual memory.
- Turning it off is not recommended, even with lots of RAM: memory errors appear and crash dumps are no longer written.
- If the machine handles confidential data, the security policy “Shutdown: Clear virtual memory pagefile” (the
ClearPageFileAtShutdownvalue) wipes it at every shutdown. Shutdown then takes longer. - On a stolen or decommissioned machine, only disk encryption (BitLocker) protects what the file holds.
Useful commands
# Current paging file usageGet-CimInstance Win32_PageFileUsage | Select-Object Name, AllocatedBaseSize, CurrentUsage
# Is Windows managing the size automatically?(Get-CimInstance Win32_ComputerSystem).AutomaticManagedPagefile
# Manual configuration, if any (empty if the system manages the size)Get-CimInstance Win32_PageFileSetting
# Actual file size (hidden), in MB(Get-Item C:\pagefile.sys -Force).Length / 1MB