Can swap file or a swap partition be mounted and read?

Mr-Bisquit · 06-07-2009, 08:02 PM

If so, how is the process done?

MS3FGX · 06-07-2009, 09:44 PM

Not sure I understand the question. Mounted and read in what way? Swap isn't like a directory that is full of various temporary files, it wouldn't be a usable filesystem. You could maybe grep a swap file for some particular string of data, but trying to extract usable information is another matter.

What exactly is your end goal? Perhaps that would make this is a little easier to work through.

pixellany · 06-07-2009, 10:12 PM

The key to this is that you do not mount a partition---you mount (connect) a filesystem to the master directory tree. Since swap space does not use a filesystem, there is nothing to mount.

Swap space is simply an alternative memory area. If you can read RAM (assuming you know what you are looking for), then you can read swap the same way---eg using dd + hexdump.

Mr-Bisquit · 06-08-2009, 02:16 PM

Solved: testdisk and photorec.