Performance Options (SystemPropertiesPerformance)

Run: SystemPropertiesPerformance.exe

Three tabs controlling system performance behavior: Visual Effects, Advanced, and Data Execution Prevention.

Visual Effects Tab

• Adjust for best performance: Disables all animations, shadows, and visual effects — recommended for VMs, older hardware, or RDS/terminal servers
• Adjust for best appearance: Enables everything
• Custom: Select individual effects — most useful middle ground is disabling animations while keeping font smoothing

Advanced Tab

• Processor scheduling: "Programs" for workstations (foreground app gets priority), "Background Services" for servers
• Virtual Memory: Configure the pagefile

Pagefile (Virtual Memory)

Windows uses pagefile.sys on the system drive for virtual memory when RAM is exhausted. Default: System managed. Custom sizing recommendation: 1.5x installed RAM for initial and maximum size, placed on the fastest available disk.

Multiple pagefiles across drives can improve performance in high-memory-pressure scenarios.

Pagefile Forensics

pagefile.sys is a hidden system file at the root of the drive. It contains memory pages swapped out from RAM and may hold:

• Fragments of plaintext passwords
• Encryption keys
• Document content
• Process artifacts

Forensic tools: Volatility (imagecopy plugin), pf-analyzer, or mount and search with strings tools.

Disable pagefile for forensic acquisition:

powercfg /h off

This also disables fast startup, preventing hybrid hibernation from interfering with clean forensic collection.

Data Execution Prevention (DEP) Tab

Mark memory regions as non-executable to prevent shellcode execution. Options: DEP for Windows programs only, or for all programs. Modern Windows enforces DEP via hardware (NX bit) — software DEP is the fallback.