Extracting from pagefile.sys?

[gold2]

After waking up my laptop to my dismay I saw a BSOD memory dump. After restarting in safe mode I got a message about a temporary paging file being made. Previously, I had some some unsaved notepad files and the only thing I found after researching it a bit was that maybe windows had paged out notepead.exe's memory to the page file. However, I have no idea where pagefile.sys is let alone how to go about extracting something from it. I also had some unsent mozilla crash reports that I wanted to send.

Perhaps more important is why this happened in this first place. Though I hadn't restarted my laptop in months there hadn't been any critical issues. Yesterday, microsoft word was giving me a hard time. I had renamed a file I was working on before saving thinking nothing of it but when I went to save it later it threw a tantrum about not being able to save or read from the disk (no doubt because of the name change) and suddenly the file name became ~W[random characters]. However, when I checked the folder the document had the proper name and it was properly saved and could be attached to an email and all that. Word was giving me a hard time about closing the junky open windows but I settled with dealing with it tomorrow. My computer went to sleep as usual. It's an incredibly frustrating thought that a name change could've impacted virtual memory so much that a crash occurred.

 

[paul1149]

Pagefile.sys is kept in the root directory of whatever drives on which it is enabled (System properties/advanced system properties/advanced/performance), usually the C drive (C:\pagefile.sys). But as a system file it is hidden until you change the View settings at Folder Options.

If you've used the machine much since the crash, chances are the pagefile is significantly altered from before your BSOD event. If the machine was in Hibernation prior to the BSOD, everything should be in the C:\hiberfil.sys file. If so, see Can you extract memory contents from a hibernated Windows machine?, and don't put the machine in hibernation again until this is resolved. If the machine was merely in Sleep, there will be no non-volatile record of the unsaved files.

If for some reason a Restore Point was created just prior to Sleep though, unsaved files may be stored there. There are progs that will extract from a restore point.

Windows MUST be rebooted periodically. It's undercarriage gets too unstable and has to be refreshed, or the kind of breakdowns you refer to are what will occur.

If you do serious .txt work, consider a quality program like PSPad that will do autobackups.