Clear Pagefile at Shutdown

Whether the pagefile is overwritten at shutdown, which decides if it holds evidence.

Use it to tell whether a clean shutdown would have wiped the pagefile before you imaged it.

SYSTEM
Defence Evasion

What It Is

The paging file, pagefile.sys, is where Windows moves pages of memory to disk while they are not in use. Because of that it can hold copies of information from memory, and while Windows runs only the system itself can open it. A security policy, off by default, makes Windows clear the paging file at each normal shutdown, which can add several minutes to the shutdown. The Memory Management key in the SYSTEM hive holds the paging file's settings, including this one.

What It Proves

ClearPageFileAtShutdown set to 1 makes Windows overwrite pagefile.sys during a clean shutdown. After one, do not expect to carve credentials or plaintext from the pagefile.

What It Does Not Prove

It wipes only at a clean shutdown, not while running or on a hard power-off. The default is 0, so a 1 that appears before a deliberate shutdown is an anti-forensics signal.

Where It Lives

Clear Pagefile at Shutdown lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

SYSTEM\ControlSet001\Control\Session Manager\Memory Management

C:\Windows\System32\config\SYSTEM

What It Looks Like

These are two values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in Clear Pagefile at Shutdown, each with what it tells you
Registry Value	What It Tells You
`ClearPageFileAtShutdown` `REG_DWORD0x00000000 (0)`	It holds the default, 0, so the clean shutdown at 16 Oct 2026 18:47 UTC left pagefile.sys intact. Collect it, since it may hold fragments of memory.
`ClearPageFileAtShutdown` `REG_DWORD0x00000001 (1)`	A clean shutdown overwrites pagefile.sys, so expect nothing to recover from it. If it changed to 1 shortly before a shutdown, treat that as anti-forensics.

How to Read It

Read ClearPageFileAtShutdown under Session Manager\Memory Management. 0 is the default (not cleared), and 1 means a clean shutdown overwrites the pagefile. If it is 1, prefer a live image or a hard power-off before shutdown to preserve pagefile.sys.

When Windows Writes It: It is written when Group Policy or an administrator changes the value. It acts at the next clean shutdown.
Which Windows Versions: Windows XP to 11
Tools That Parse It: Registry Explorer, RECmd, RegRipper

Hunt It

Cannot See ItSYSTEM hive, parsed offline

Defender is not known to record this key. Read it with Velociraptor, or collect the SYSTEM hive and parse it.

Parse the Hive Instead

Collect: C:\Windows\System32\config\SYSTEM
Parse With: Registry ExplorerRECmdRegRipper

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Clear Pagefile at Shutdown shows.

Last Shutdown TimeDates the clean shutdown that would have wiped the pagefile.
Pagefile on DiskNot in the RegistryIt is what this setting wipes, so check whether it still holds data.

Sources

The facts on this page come from these public pages, which say more on each point.