Difference between revisions of "Windows SuperFetch Format"
|Line 35:||Line 35:|
| "MEMO" (0x4d, 0x45, 0x4d, 0x4f)
| "MEMO" (0x4d, 0x45, 0x4d, 0x4f) "MEM0" (0x4d, 0x45, 0x4d, 0x30)
Revision as of 13:25, 15 April 2014
Note that the following format specification are incomplete.
- 1 SuperFetch DB files
- 2 TRX files
- 3 See Also
- 4 External Links
SuperFetch DB files
The Ag*.db files are of the SuperFetch file format. E.g.
AgAppLaunch.db AgCx_SC*.db AgGlFaultHistory.db AgGlFgAppHistory.db AgGlGlobalHistory.db AgGlUAD_P_%SID%.db AgRobust.db
The SuperFetch DB files can be stored in uncompressed or compressed form.
- Compressed SuperFetch DB - MEM file format; Windows Vista and 7
- Compressed SuperFetch DB - MAM file format; Windows 8
Compressed SuperFetch DB - MEM file format
The MEM file consists of:
- file header
- compressed blocks
The file header is 84 bytes of size and consists of:
|0||4|| "MEMO" (0x4d, 0x45, 0x4d, 0x4f)
"MEM0" (0x4d, 0x45, 0x4d, 0x30)
|4||4||Uncompressed (total) data size|
- "MEMO" (0x4d, 0x45, 0x4d, 0x4f) is used on Windows Vista
- "MEM0" (0x4d, 0x45, 0x4d, 0x30) is used on Windows 7
The file header is followed by compressed blocks:
|0||4||Compressed data size|
Compressed SuperFetch DB - MAM file format
On Windows 8 (seen on 8.1) the MEM file format seem to have been replaced by the MAM file format.
|0||4||"MAM\x84" (0x4d, 0x41, 0x4d, 0x84)||Signature|
Uncompressed SuperFetch DB format
The Ag*.db.trx files are of the TRX file format. E.g.
Note that the following format specification is incomplete.
The file header is variable of size and consists of:
|12||4||Maximum number of records (of the record offsets array)|
|16||4||Number of records|
|20||...||Record offsets array, where the record offset is a 32-bit integer. Unused record offset are set to 0.|
- Windows SuperFetch file format – partial specification, by ReWolf, October 5, 2011