how to read virtual memory

[Winuser]

Hi,

Can anyone please let me know how the one may read files from virtual memory(pagefile.sys)? Is there a software to read all files from this file in human readable form?

 

[logicearth]

What is it you are trying to do? Furthermore, Virtual Memory is more then just the page file.

 

[zsxd45]

Hi,

Can anyone please let me know how the one may read files from virtual memory(pagefile.sys)? Is there a software to read all files from this file in human readable form?

Go To: Computer > System Properties > Advanced System Settings > Performance > Settings > Virtual Memory | Hope That Helped!

 

[zsxd45]

Hi,

Can anyone please let me know how the one may read files from virtual memory(pagefile.sys)? Is there a software to read all files from this file in human readable form?

Go To: Computer > System Properties > Advanced System Settings > Performance > Settings > Virtual Memory | Hope That Helped!

After Performance click advanced then virtual memory is at the bottom.

 

[Winuser]

zsxd45, how at Computer > System Properties > Advanced System Settings > Performance > Settings > Virtual Memory I am supposed to read Virtual File memory file?
I wasnt asking about tweaking memory size.

 

[DeaconFrost]

What is it you are trying to do, or why do you think you need to access some kind of information sotred in that file?

 

[Winuser]

What is it you are trying to do, or why do you think you need to access some kind of information sotred in that file?

There are a number situations where the one would need such a tool.
For example you are sitting behind your desktop and electricity goes off/or PC freezes/you need to debug something/etc and the only way to recover unsaved work would be to try to look over virtual memory file(considering the temp files etc arent available).

 

[logicearth]

You would need very special software what is tailored to a very specific application to recover anything of use from raw memory. Data can be fragmented, broken into pieces, or encoded in some bizarre format. As well the contents of RAM would also have to be in the pagefile which may not be the case.

Such a tool doesn't exists because it would need to be very specific. However, you can peek in side application's memory by using debugging tools, like Process Explorer.

Furthermore, Virtual Memory does not mean it is in the pagefile.

 

[Winuser]

You would need very special software what is tailored to a very specific application to recover anything of use from raw memory. Data can be fragmented, broken into pieces, or encoded in some bizarre format. As well the contents of RAM would also have to be in the pagefile which may not be the case.

Such a tool doesn't exists because it would need to be very specific. However, you can peek in side application's memory by using debugging tools, like Process Explorer.

It seems that scuh a powerful tool indeed exist MANDIANT: Intelligent Information Security | Free Software

Furthermore, Virtual Memory does not mean it is in the pagefile.

Elaborate please.

 

[logicearth]

It seems that scuh a powerful tool indeed exist

That does not do what you asked for it. Sure it lets you view memory, the raw data.

Elaborate please.

Mysteries of Windows Memory Management Revealed, Part 1 of 2 | PDC 2010 | Channel 9