Ethical hacking tutorials

Windows 95 And Above

From Windows 95 onwards, Microsoft encouraged the use of its new dynamic virtual memory system. Of course, there is nothing new about the virtual memory part but the keyword in this new technique is dynamic.

The new dynamic virtual memory system no longer relies on a fixed-size swapfile but a paging file that dynamically resizes itself according to need. When the computer runs out of memory, more memory is created by increasing the size of the paging file. Once the virtual memory is freed up, theoretically the paging file diminishes in size.

Microsoft claims that while its dynamic virtual memory system will create a fragmented paging file, it is still faster than Windows 3.1's static virtual memory system. As a bonus, no hard disk space will be tied up in a permanent paging file.

However, this dynamic virtual memory system does have a big disadvantage - it cannot be moved to the outer tracks of the hard disk platters.

Dynamic Paging Files And Data Locality

There are people who assert that when left alone, Windows XP will actually create virtual memory pages in close proximity to frequently-used data in the hard disk, like documents. In other words, they claim that Windows XP monitors disk usage, maintains a database of frequently-used files in the hard disk and uses that information to create the paging file based on spatial locality.

With virtual memory pages created close to frequently-used data, this apparently allows shorter seeks between frequently-used data and the paging file. That is the premise behind their theory of letting Windows XP handle the paging file dynamically. However, I don't think this is true at all.

First of all, while Windows XP does monitor disk usage and maintain a database of frequently-used files, only disk defragmenting utilities use that database. The built-in Disk Defragmenter, as well as third-party disk defragmenting utilities, use this database to rearrange the hard disk so that frequently-used data.

But as far as I'm aware, the paging file does not arrange the location of the pages according to this database. From my observations, Windows XP simply uses the nearest available clusters for the dynamic paging file.

In fact, Microsoft states that if you create multiple paging files, Windows XP will favour the partition that is least active. This completely refutes the theory of virtual memory pages being allocated according to spatial locality. Here is a quote from Microsoft's Knowledge Base.

By design, Windows uses the paging file on the less frequently accessed partition over the paging file on the more heavily accessed boot partition. An internal algorithm is used to determine which paging file to use for virtual memory management.

In any case, it doesn't make sense for Windows XP to create the paging file based on spatial locality to work files like your documents. Once opened, Windows keeps the working copy in the Temp folder, not your paging file.

In addition, let us remember that Windows pre-emptively pages out pageable parts of an application in system memory. Windows does not directly load data from the hard disk into the paging file. Therefore, creating virtual memory pages close to frequently-used files will not help at all.

Fragmented Vs. Contiguous

Even though Microsoft asserts that the new dynamic virtual memory system does not benefit much from a contiguous paging file, the fact is maintaining a contiguous paging file will definitely improve the paging file's performance.

A contiguous paging file eliminates the need for the hard disk heads to seek all over the platters while accessing the paging file. The following pictures illustrate my points.


This shows a fragmented paging file (brown)


This shows a contiguous paging file (brown)

See how a contiguous paging file differs from a fragmented paging file? Instead of seeking and reading from a continuous block of hard disk space in the case of a contiguous paging file, the hard disk heads have to seek all over the platters to access the clusters allocated to a fragmented paging file.

As a result, a common operating pattern like the following may emerge :-

Fragmented : seek-read-read-seek-read-seek-read-read-read-seek-read-read-seek
Contiguous : seek-read-read-read-read-read-read-seek-read-read-read-read-read

Of course, the amount of time needed to do the seek operation is different from the time needed to read a block of data off the paging file but the logic remains.

A contiguous paging file allows data to be read with minimal amount of seeks. If the number of seeks can be reduced while accessing the paging file, then more data can be read in less time. This is the premise behind a contiguous paging file.

How Do We Create A Contiguous Paging File?

Now that we agree that making the paging file contiguous will greatly improve its performance, let's figure out how to make it contiguous.