| Author | Message | ||
     edw Username: jw4444 Registered: N/A |
I want to view and make a copy of the pagefile.sys of the Windows (XP SP2) that im currently working on (running WinHex on). I've read several places that Winhex can do this. I am Administrator, I have "open files thru operating system" *un*checked. I click on pagefile.sys in the directory browser and get (I presume) the first sector. I can right-click and get a list of clusters that looks right. But if i try open or copy/recover I get a 72 byte file that is (identical to) the "desktop.ini" file in the "Temporary Internet Files" folders. This seems odd...am I doing something wrong? Thanks. | ||
| Stefan Fleischmann Username: admin Registered: 1-2001 |
Maybe the volume snapshot is outdated. Please try taking a new one. | ||
| edw Username: jw4444 Registered: N/A |
Well, I've done so several times and I just now exited Winhex, deleted *.dir files, run Winhex again. The "traversing C" stage takes ~10 minutes and generates a 140Meg .dir file in the temp directory. Got the same results as I described. The list of clusters is always the same and the file it opens/copies is the same. I note when I open pagefile.sys the detail sidebar says nothing about what secor/cluster i'm looking at, only the offset in the file. I note the list of clusters has 4 consecutive clusters listed then a line of dashes, then (many) more consecutive clusters. (what's the line signify?) | ||
| Stefan Fleischmann Username: admin Registered: 1-2001 |
> The list of clusters is always the same and the file it > opens/copies is the same. Sorry, cannot explain, then. > (what's the line signify?) (Obviously an interruption of a flow of consecutive clusters.) |