It was something brought up by Joanna Rutkowska that her original pagefile attack on Vista was now stalled because Microsoft removed the ability of administrative users to perform write operations on the physical disk. So what happens to all those developers of undelete utilities (use a second disk?).
Firstly, lets look at the attack in more detail. What happens is that the kernel is forced to swap out pages of memory from drivers that are loaded in the kernel. These pages are swapped out to disk. I for one find this to be an incredibly stupid place to swap out the pages, as after all, until the kernel is completely done with a driver the original copy remains on disk.
Ok, maybe it had something to do with the new paging mentality of vista (you can page onto a usb memory device if it’s fast enough).
Damn, I’m talking myself out of my own argument.
No, paging of code from binaries should revert to the on-disk copy unless they have made COW modifications to their segments (does windows do this?)
If it wasn't for carbon-14, I wouldn't date at all