ForensicsWiki will continue to operate as it has before and will not be shutting down. Thank you for your continued support of ForensicsWiki.

Difference between revisions of "Windows SuperFetch Format"

From ForensicsWiki
Jump to: navigation, search
(MEMO file)
(External Links)
Line 52: Line 52:
  
 
== External Links ==
 
== External Links ==
* [http://blog.rewolf.pl/blog/?p=214 Windows SuperFetch file format – partial specification]
+
* [http://blog.rewolf.pl/blog/?p=214 Windows SuperFetch file format – partial specification], by ReWolf, October 5, 2011
  
 
[[Category:File Formats]]
 
[[Category:File Formats]]

Revision as of 17:51, 14 April 2014

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

MEMO file

Th MEMO file consists of:

  • file header
  • compressed blocks

File header

The file header is 84 bytes of size and consists of:

Offset Size Value Description
0 4 0x304D454D ("MEM0") or 0x4F4D454D ("MEMO") Signature
4 4 Uncompressed (total) data size

Compressed blocks

The file header is followed by compressed blocks:

Offset Size Value Description
0 4 Compressed data size
4 ... Compressed data

See Also

External Links