Is there any way to know which which part of the file are still in the Physical RAM after it was read by some process.

Question

Lets say I used a program that read a file and that the program was finished. Now , most likely that parts of the file still reside in the physical ram (lets assume I have huge amount of RAM).

Is there any way to know which parts of the file reside in the physical ram? Is there any tool that can do it or maybe a winapi function call?

Answer 1

A few points to remember:

1. You never have direct access to physical RAM. The OS gives you an abstraction of RAM. It may be physical RAM, or virtual memory paged away on some hard disk. You can never know.
2. Even if some bits remain stashed away in some part of the RAM (physical or otherwise), the OS sees that memory block as free (unless it has already been taken again). I doubt you can get access to it without hacking the OS somehow.

Let me clarify my point in regards to your comment:

Let's assume you opened a file, read it to RAM, did some stuff with it, and closed the file, and your program has terminated. First, I think we all agree that the portion of RAM you used is no longer taken, and is considered free by the OS. Meaning another program that comes along and demands some RAM might receive that memory block. So, first of all, nothing resides in that memory block anymore. It's empty. Free for the OS to use at its discretion.

Now, even if some random bits of data are left hanging around (remember, you have no way of knowing if it's physical or otherwise), you have no direct access to them.

I hope this clarifies.

Answer 2

if you are talking about Windows, the content will be in Windows file cache.

there's no tool/API to read Windows file cache now.

However, you can read all contents in your physical memory by a special name like CreateFile('\\.\PhysicalMemory') or the name \Device\PhysicalMemory. (note: only works on XP/2000)

Answer 3

> there's no tool/API to read Windows file cache now.

Of course there are apis (Win32 st) !