Windows SuperFetch Format
Some of the Ag*.db files are MEM files.
The MEM file consists of:
- file header
- compressed blocks
The file header is 84 bytes of size and consists of:
|0||4||"MEMO" (0x4D, 0x45, 0x4D, 0x4f) or "MEM0" (0x4D, 0x45, 0x4D, 0x30)||Signature|
|4||4||Uncompressed (total) data size|
- "MEMO" (0x4D, 0x45, 0x4D, 0x4f) is used on Windows Vista
- "MEM0" (0x4D, 0x45, 0x4D, 0x30) is used on Windows 7
The file header is followed by compressed blocks:
|0||4||Compressed data size|
On Windows 8.1 the MEM file format seem to have been replaced by the MAM file format.
|0||4||"MAM\x84" (0x4d, 0x41, 0x4d, 0x84)||Signature|
The Ag*.db.trx files are TRX files.
Note that the following format specification is incomplete.
The file header is variable of size and consists of:
|12||4||Maximum number of records (of the record offsets array)|
|16||4||Number of records|
|20||...||Record offsets array, where the record offset is a 32-bit integer. Unused record offset are set to 0.|
- Windows SuperFetch file format – partial specification, by ReWolf, October 5, 2011