• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

Possible to recover data from a win XP swapfile???

Originally posted by: AMD Die Hard
Anyone know if it is possible and if so how?
Click to expand...

In theory yes, the file is not encrypted and not wiped at shutdown (unless specifically configured to do so). Can you be a little more specific on what you hope to do?

Bill
 
Not encrypted, not wiped at shutdown. Its a multi disk system. I was running the swapfile on G: and the OS on C:. After a hardware related RAID failure, the OS was restored to an earlier time along with all documents. The swapfile defaulted to C: leaving the G: swapfile untouched. The swapfile is 1.5 GB. I was hoping to recover some word docs from it. what can I use to open, catalog, or search it? I know the documents I want all fall in a ceratin date range and that date range is immediately after tha last use of the swapfile.
 
Highly unlikely, only random 4k chunks of text (at best) would be in there. You aren't likely to find documents in any format you actually recognize them (and unless you were low on memory in the first place, it's unlikely any of the data would have been paged out anyhow).

I don't know of any specific pagefile editing tools, but you can copy it to another file and look for a text viewer that deals with huge files (or an app to split it into managable chunks)

Bill
 
Originally posted by: AMD Die Hard
Not encrypted, not wiped at shutdown. Its a multi disk system. I was running the swapfile on G: and the OS on C:. After a hardware related RAID failure, the OS was restored to an earlier time along with all documents. The swapfile defaulted to C: leaving the G: swapfile untouched. The swapfile is 1.5 GB. I was hoping to recover some word docs from it. what can I use to open, catalog, or search it? I know the documents I want all fall in a ceratin date range and that date range is immediately after tha last use of the swapfile.
Click to expand...

Doesn't word auto-save documents. Anyways just try opening the file with word pad and searching for some text you know is in the file like "the." I have recovered some documents out of the swap file in win 9x and they where in the correct order and just some non-ascii characters where added.
 
Yes, but.. the Win9x swapfile (actually, a combined swapfile and paging file), has a different organization than the W2K/XP paging file (not actually a "swap" file at all).

Technically, NT-based paging always operates in 4KB (page-sized) chunks (unless it does something different with 4MB pages, but I disable those anyways), whereas in Win9x, it could either page a 4KB chunk, or swap an entire 16-bit protected-mode segment into the file. Hence there is a greater chance of finding contigous data in the Win9x file than the W2K/XP one.
 
Ultra-Edit 32 will handle files that large.

I believe what Bill & Larry are trying to say is that due to the FRAGMENTATION of
the swapfile (just like a HD), it would be highly unlikely that you could search the
correct segments for each of the files you seek without the original filetable.
 
Actually, that is not what we are saying. The system only writes 4k chunks of data at a time to the file (even if it's one large contigous file). As such, your only likely to find small peices of previous data, and if you do, it can be randomly scatetered about in the file.
 
And that's assuming the system was low enough on RAM that it needed to swap something from Word to the pagefile (very unlikely if it's an active aplication and you have enough RAM).
Doesn't word auto-save documents.
Click to expand...
Yes the later versions are configured by default to save backups in the event that Word crashes, but that doesnt really have anything to do with the paging file.

I'm not certain about where and how those are saved but I think you can look for hidden files in the same directory as your documents with ~*.doc for the name. If you had never saved them they should be in your profile's /local settings/temp directory.

Good Luck,

-Erik
 
You must log in or register to reply here.

TRENDING THREADS

Back
Top