Windows 8 Memory Management

Since Windows 8, there are now two Swapfiles: pagefile.sys and swapfile.sys.


Until today, this file was at least as big as your physical memory. Per default, windows sized this file like RAM*1.5. This also was to reserve enough space for the per default enabled kernel memory dump (system properties -> advanced -> startup and recovery).

On Windows 8 there’s a new option to configure the memory dump called “automatic memory dump”. Automatic means if there’s enough space at the moment of the crash, it’ll do a full dump; if not, Windows just writes a small dump.




swapfile.sys is a system controller file, normally around 256MB. It’s used by Metro style applications that don’t fit the traditional paging characteristics (such as usage pattern, growth, space reservation) of pagefile.sys. One example of swapfile.sys usage is the suspend/resume of Metro-style applications; however, this is not the only use.

You’ll find more detailed technical description here:

About hiberfil.sys

This file was as huge as the total amount of RAM installed in your computer. Now it will be sized for 75% of the physical memory but only has 10-15% of that size of data in it. That’s because of two main things: (1) the traditional desktop only gets loaded after a user explicitly needs it. This reduces the Memory usage of the Kernel. And (2) Windows Quick-Boot (“clean slate”) closes User sessions before shutting the computer down.

To change the size of hiberfil.sys use this command:

powercfg /hibernate /size

To “full”-shutdown the computer:

shutdown /s /full /t 0

Memory Deduplication

As explained in the MSDN Blog for Windows 8, the MS developers implemented a background job that searches for memory of Applications, that is allocated for future use and initialized with all the same value. As they noticed, applications may never actually use this memory because it’s there waiting to be used for a function that maybe never gets invoked. So if multiple applications are doing this, there’s redundant memory.

The technique’s called “Memory combining” and is already known on ESX servers where redundant copies of memory are combined once to save physical memory. VMware calls it “shared memory”. As soon as the only copy of memory gets modifies by an application, the modified data gets a private copy of it. As written in the Blog: “All of this happens under the covers in the memory manager, with no impact on applications.”


Other ways to reduce memory consumption

There’s a new Startup Mode for Windows Services called “start on demand”. Those services only get started if they’re triggered by the OS. An example for this could be a newly plugged in USB device.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s