Has an EXE program in the process of running generates a temporary file, such as the TMP, but program soon put it deleted, what method can make ABC. TMP copy out?

CodePudding user response:

Process management software or debug software, let it suspension or interruption, then try to copy; If used hints file could not be copied, try WinHex such disk editing software, open the file's disk, find file directory in one by one, it wrote other dish, but may be not the latest content, or have no brush to disk in memory,

CodePudding user response:

Please recommend a process management software or debugging software

CodePudding user response:

Process management software, to halt the process function can have a try in SysinternalSuite procexp. Exe. Debug software can try windbg or Ollydbg,

CodePudding user response:

FDump - Dumping File Sectors Directly from Disk using Logical Offsets http://www.codeproject.com/Articles/32169/FDump-Dumping-File-Sectors-Directly-from-Disk-usin