Windows stores personal data in at least 15 hidden locations that most users never see. These include memory dump files containing passwords and clipboard contents (pagefile.sys), thumbnail previews of deleted images (thumbcache), logs of every program you have ever launched (Prefetch), records of every USB device ever connected (registry USBSTOR), and saved Wi-Fi passwords in exportable plain text. Standard cleanup tools miss most of these. Univik File Eraser‘s Clean System Traces feature targets all 15 locations in a single operation.
Introduction
You can delete your files and clear your browser history and empty the Recycle Bin. Windows will still know what you did. The operating system maintains dozens of hidden files and databases and registry entries that record your activity in ways most users never realize. These are not surveillance features. They exist for legitimate performance and usability reasons. But they create a detailed record of your behavior that persists long after you think you have cleaned up.
This guide documents the 15 most significant hidden data stores in Windows, explains exactly what personal information each one contains and shows you how to find them on your own system. If any of these locations concern you, the final section covers how to permanently destroy them all.
1. Pagefile.sys: Your RAM Written to Disk
Location: C:\pagefile.sys (hidden, system-protected)
When your computer runs low on physical RAM, Windows moves inactive memory pages to a file on disk called the page file (also known as virtual memory or swap). This file can grow to several gigabytes and its contents are a raw dump of whatever was in memory at the time.
What ends up in pagefile.sys is alarming. Passwords you typed into login forms. Credit card numbers entered during online purchases. Clipboard contents you copied and pasted. Fragments of documents you were editing. Chat messages from Teams and Slack and Discord. Email content from Outlook. Encryption keys from BitLocker and other security tools. Any data that passed through RAM can end up in the page file, written to disk in an unencrypted state.
The page file is not cleared when you shut down Windows (by default). It persists across reboots, meaning a forensic examiner or anyone with physical access to the drive can extract these fragments without ever logging into your account.
2. Hiberfil.sys: A Snapshot of Everything Open
Location: C:\hiberfil.sys (hidden, system-protected)
When you close the laptop lid or put your PC to sleep, Windows writes the entire contents of RAM to hiberfil.sys. This file is typically 40-75% of your total RAM size. On a 16 GB system that means 6-12 GB of raw memory data saved to disk.
Unlike the page file which contains fragments, the hibernation file is a complete snapshot of your system state. Every open document. Every browser tab with its full page content. Every logged-in session. Every running application with its in-memory data. If you hibernate with your email client open, hiberfil.sys contains your emails. If you hibernate with a password manager unlocked, the decrypted passwords may be in the file.
Windows Fast Startup (enabled by default since Windows 8) uses a partial hibernation file even during normal shutdowns. This means hiberfil.sys contains sensitive data even if you never manually use hibernate mode.
3. Thumbnail Cache: Images You Deleted Still Have Previews
Location: C:\Users\[name]\AppData\Local\Microsoft\Windows\Explorer\thumbcache_*.db
When you view a folder containing images or videos in Windows Explorer, the system generates thumbnail previews and stores them in a database. These thumbnails persist even after you delete the original files. If you downloaded a photo and deleted it five minutes later, the thumbnail remains in the cache indefinitely.
Forensic examiners routinely extract thumbnail caches because they reveal exactly which images existed on the computer at some point. The cache files (thumbcache_32.db, thumbcache_96.db, thumbcache_256.db and thumbcache_1024.db) store previews at different resolutions. Even the smallest 32-pixel thumbnails can identify people and locations and content.
Disk Cleanup’s “Thumbnails” option clears these files but they regenerate as soon as you browse folders containing images. The deleted entries remain recoverable until overwritten.
4. Prefetch Files: A Log of Every Program You Run
Location: C:\Windows\Prefetch\
Windows Prefetch records the name and execution timestamp of every application you launch. Each .pf file in this folder represents a program with metadata including the last eight execution times and the total number of times it has been launched. The folder maintains records for the most recent 1,024 applications.
This means anyone examining your computer can see exactly which programs you ran and when. Portable applications that you launched from a USB drive and then removed still leave Prefetch records. Uninstalled software still has entries. Applications you ran once out of curiosity years ago may still appear in this folder.
5. Recent Files and Jump Lists: Your Activity Timeline
Location: C:\Users\[name]\AppData\Roaming\Microsoft\Windows\Recent\ and ...\Recent\AutomaticDestinations\
Windows maintains a list of recently accessed files in .lnk (shortcut) format. Every document you open creates an entry. These shortcuts persist even after you delete the original file because the shortcut and the file are stored separately.
Jump Lists take this further. Right-clicking an application in the taskbar shows recently opened files for that application. These records are stored in AutomaticDestinations and CustomDestinations folders as binary files. They contain full file paths and timestamps and reveal which documents each application accessed. The “Clear recent files” option in Windows Settings removes the visible list but does not securely overwrite the underlying database files.
6. USB Device History: Every Device Ever Connected
Location: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR (registry)
Windows records every USB storage device ever connected to the computer in the registry. Each entry includes the device manufacturer and product name and serial number and the first and last connection timestamps. This record persists indefinitely even after the device has been disconnected and never reconnected.
This data reveals which USB drives and external hard drives and phones were connected to the machine. In corporate and forensic contexts, USB history is frequently examined to determine whether data was copied to removable media. Clearing this requires editing the Windows registry, which most users are not comfortable doing manually.
7. Browser Databases: More Than Just History
Location: C:\Users\[name]\AppData\Local\Google\Chrome\User Data\Default\ (Chrome example)
Clicking “Clear browsing history” in your browser does not erase the underlying SQLite database files. Chrome and Edge and Firefox store browsing data in multiple database files. Clearing history through the browser UI deletes records from the active tables but the deleted entries remain in the database file’s free pages until the database engine reclaims them.
Beyond history, browsers store data in files that “Clear browsing data” does not fully address. The Favicons database contains icons for every site you have visited (revealing browsing patterns even after history is cleared). The Login Data file stores saved passwords in encrypted form but the encryption key is stored locally. The Web Data file contains auto-fill entries: addresses and phone numbers and credit card details. The Cookies file persists tracking identifiers even after you clear cookies because some databases use write-ahead logs that retain older records.
8. Windows Event Logs: A Silent Audit Trail
Location: C:\Windows\System32\winevt\Logs\
Windows Event Viewer maintains detailed logs of system activity. The Security log records every logon and logoff event (including failed attempts with timestamps). The Application log records program crashes and installations. The System log records driver loads and service starts and shutdowns. PowerShell logs record every command executed in PowerShell sessions.
These logs can reveal when the computer was used (logon timestamps), which programs were installed and removed (application logs), when USB devices were connected (system device events) and what administrative actions were taken. Logs are retained based on size limits (default 20 MB per log file) and can contain weeks or months of activity records.
9. Wi-Fi Profiles: Networks and Passwords in Plain Text
Location: C:\ProgramData\Microsoft\Wlansvc\Profiles\Interfaces\ (XML files)
Windows stores Wi-Fi network profiles including passwords for every network you have ever connected to. The password is stored in an encrypted XML file, but anyone with administrator access on the machine can extract it in plain text using a single command:
netsh wlan show profile name="NetworkName" key=clear
This reveals the network name and the password in the “Key Content” field. The list of stored networks also reveals your location history: home networks and office networks and hotel Wi-Fi and airport lounges and coffee shops all appear in the profile list, each with connection timestamps.
10-15. Six More Hidden Data Stores
10. Windows Search Index (C:\ProgramData\Microsoft\Search\Data\). The Windows Search index contains a full-text index of documents and emails and file contents on the drive. Deleted files may still have indexed entries. The database can be several gigabytes and contains searchable text fragments from thousands of files.
11. Recycle Bin metadata (C:\$Recycle.Bin\). Even after emptying the Recycle Bin, the $I files (metadata records) can reveal the original file names and paths and deletion timestamps of everything you have ever deleted.
12. Clipboard history (stored in memory and synced to cloud if enabled). Windows 10/11 clipboard history (Win+V) stores the last 25 copied items. If cloud sync is enabled, clipboard contents are sent to Microsoft servers and available on other devices signed into the same account.
13. Windows Timeline / Activity History. Records which applications you used and which files you opened and which websites you visited, with timestamps. Microsoft syncs this data across devices if activity sync is enabled.
14. Crash dump files (C:\Windows\Minidump\ and C:\Windows\MEMORY.DMP). When Windows crashes (blue screen), it writes RAM contents to disk as a dump file. Like pagefile.sys, these dumps contain whatever was in memory at crash time: open documents and passwords and encryption keys.
15. Office and application temp files (C:\Users\[name]\AppData\Local\Temp\). Microsoft Office creates temporary copies of documents while editing. These temp files often persist after the original is closed and may contain earlier versions of documents you have since modified or deleted.
How to Clean All Hidden Data with Univik File Eraser
Univik File Eraser‘s Clean System Traces feature targets all of these hidden data stores in a single operation. It identifies and securely overwrites:
Browser data (history databases and favicon caches and auto-fill records and saved login files and cookie databases across Chrome and Edge and Firefox). System caches (thumbnail cache and Prefetch files and recent file lists and jump lists and Windows Search index entries and clipboard history). Temporary files (application temp directories and Office recovery files and crash dumps). System logs (event log entries and PowerShell history).
After cleaning system traces, run Wipe Free Space to overwrite the sectors where these files previously existed. This two-step process ensures that both the active hidden files and any residual data from previously deleted traces are permanently destroyed.
For ongoing protection, schedule regular Clean System Traces runs (weekly or monthly depending on sensitivity) to prevent accumulation of recoverable personal data in these hidden locations.
Frequently Asked Questions
Does Disk Cleanup remove all of these hidden files?
No. Disk Cleanup addresses only a few of these locations (temporary files and thumbnails and some caches). It does not touch the page file or hibernation file or Prefetch records or USB history or browser databases or event logs or Wi-Fi profiles. Most hidden data stores require targeted tools to clean.
Can I disable pagefile.sys to prevent data leakage?
You can disable the page file through System Properties > Performance > Virtual Memory. However, this may cause crashes or performance issues on systems with limited RAM. A better approach is to enable the Group Policy setting “Shutdown: Clear virtual memory pagefile” which forces Windows to overwrite the page file with zeros during every shutdown.
Will these hidden files rebuild after I clean them?
Yes. Windows continuously generates new data in these locations as you use the computer. Cleaning is not a one-time fix. Treat it as regular maintenance. Each cleaning session destroys the data accumulated since the last clean. Regular weekly cleaning keeps the amount of recoverable personal data at a minimum.
Does encryption protect against these hidden data stores?
BitLocker full-disk encryption protects all files (including these hidden ones) from someone who removes the drive and reads it externally. However, encryption does not help when the attacker has access to the running system because all files are decrypted transparently during normal use. Anyone who can log into the computer can access every hidden data store listed above.
Conclusion
Last verified: February 2026. File locations confirmed on Windows 11 24H2 (Build 26100). Pagefile.sys and hiberfil.sys contents analyzed with WinHex 20.9. Thumbnail cache extracted with Thumbcache Viewer 1.0.2.27. Prefetch files parsed with PECmd 1.5. Browser database free pages examined with DB Browser for SQLite 3.13. Wi-Fi password extraction confirmed with netsh on Windows 11. USB history verified in Registry Editor.
Windows stores far more about you than what you see on screen. Fifteen hidden data stores record your passwords and browsing patterns and program usage and USB connections and Wi-Fi locations and clipboard contents and document thumbnails, all persisting silently on your drive. Standard cleanup tools address a fraction of these locations. Univik File Eraser‘s Clean System Traces mode targets all of them in one operation, followed by Wipe Free Space to destroy any residual data from previous sessions.
Check your system now: Open C:\Windows\Prefetch and look at the list of .pf files. That is a log of every program you have launched. Open C:\Users\[your name]\AppData\Local\Microsoft\Windows\Explorer and check the thumbcache files. Those contain previews of images you may have deleted long ago. To permanently destroy these and all 13 other hidden data stores, run Univik File Eraser‘s Clean System Traces followed by Wipe Free Space.
