Finding Swap Space

  • Thread starter Thread starter Vagabon
  • Start date Start date
V

Vagabon

I was wondering if anyone knew who to access the swap space on a
computer to read from it (I have a hex editor). I was just wondering
how to call all the data that the swap space contains. Anyone know how
to do this, or a program that does it?
 
Previously Vagabon said:
I was wondering if anyone knew who to access the swap space on a
computer to read from it (I have a hex editor). I was just wondering
how to call all the data that the swap space contains. Anyone know how
to do this, or a program that does it?
Click to expand...

What OS?

Arno
 
You need to boot from separate OS - either separate OS install, or from a
CD-based OS (WinXP PE or Linux).
You won't be able to open *live* swap file in any OS, Not XP, not Linux, not
even Win9X.
 
Alexander Grigoriev said:
You need to boot from separate OS - either separate OS install, or from a
CD-based OS (WinXP PE or Linux).
You won't be able to open *live* swap file in any OS, Not XP, not Linux, not
even Win9X.
Click to expand...

Under Linux it's possible to read an active swap partition:

/home/gap# uname -a
Linux peregrine 2.6.15 #23 Tue Jan 10 10:23:36 EST 2006 i686 unknown
unknown GNU/Linux
/home/gap# cat /proc/swaps
Filename Type Size Used
Priority
/dev/hda9 partition 506008 152
-1
/home/gap# dd if=/dev/hda9 bs=4098 count=1 of=/tmp/swap1
1+0 records in
1+0 records out
/home/gap# ls -l /tmp/swap1
-rw-r--r-- 1 root root 4098 2006-03-16 17:21 /tmp/swap1

I also suspect it's possible to _write_ to the active swap partition,
but I'm not about to try _that_.

Jerry
 
Back
Top