How does windows 7 know that it should not swap in data from a previous boot?

Question

As you know, the page file is used as a buffer if your physical RAM runs out.

But unless HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\ClearPageFileAtShutdown = 1 the page file is not cleared after a shutdown.

When the system boots again, how does Windows know that it should not swap in data from the previous boot into the RAM? Lets say its a Power outage, the system must still know when its a "new boot"?

Is the page file deleted and recreated each boot, which would require overwriting the part of disk where the page file is stored to ensure its empty?

Or is it some data structure inside the page file that ensures windows knows whats belongs to the current boot session?

Answer 1

You can consider the page file as being an extension to memory, so the same mechanisms that you would expect for memory can be applied.

Each page in physical and virtual memory is either in use or it is not. In the same way that you wouldn't expect the OS to expect an unused page in physical memory to contain something meaningful, you would also not expect it to consider a page in virtual memory (the page file) to contain something useful and to trigger a "swap in".

At cold boot time, all memory, both real and virtual are considered empty. So a page from a page file would not be swapped in unless, in this session, it had already been swapped out. This is the function of the memory manager to know what pages contain data and which processes own them.

The purpose of the ClearPageFileAtShutdown key is not to make sure that the page file is empty so that it isn't inadvertently used when it shouldn't be. It is to ensure that the page file is zeroed out so that if the machine fell into the wrong hands, the page file could not be examined for sensitive information. It is a security measure.