Difference between revisions of "Windows SuperFetch Format"

From Forensics Wiki
Jump to: navigation, search
(MEMO file)
(2 intermediate revisions by one user not shown)
Line 1: Line 1:
 
{{expand}}
 
{{expand}}
  
== File header ==
+
== MEMO file ==
 +
Th MEMO file consists of:
 +
* file header
 +
* compressed blocks
 +
 
 +
=== File header ===
 
The file header is 84 bytes of size and consists of:
 
The file header is 84 bytes of size and consists of:
 
{| class="wikitable"
 
{| class="wikitable"
Line 22: Line 27:
 
|}
 
|}
  
== Compressed blocks ==
+
=== Compressed blocks ===
 
The file header is followed by compressed blocks:
 
The file header is followed by compressed blocks:
 
{| class="wikitable"
 
{| class="wikitable"

Revision as of 12:37, 14 April 2014

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

Contents

MEMO file

Th MEMO file consists of:

  • file header
  • compressed blocks

File header

The file header is 84 bytes of size and consists of:

Offset Size Value Description
0 4 0x304D454D ("MEM0") or 0x4F4D454D ("MEMO") Signature
4 4 Uncompressed (total) data size

Compressed blocks

The file header is followed by compressed blocks:

Offset Size Value Description
0 4 Compressed data size
4 ... Compressed data

See Also

External Links