0

In PowerShell, I am trying to make a copy of the Windows swapfile (swapfile.sys)

PS C:\> Copy-Item swapfile.sys -Destination C:\Users\

However, I recieve the error:

Copy-Item : Cannot find path 'C:\swapfile.sys' because it does not exist.
At line:1 char:1
+ Copy-Item swapfile.sys -Destination C:\Users\
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (C:\swapfile.sys:String) [Copy-Item], ItemNotFoundException
    + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.CopyItemCommand

I can confirm the file exists with attrib *.sys

Perhaps this is due to the fact it is a hidden file, or a type of file that cannot be copied? I want to investigate this file with a HexEditor and was hoping to make a stand-alone copy for this.

William Baker Morrison
  • 1,642
  • 4
  • 21
  • 33
  • Can you see the file using `gci *.sys -force`? – Abraham Zinala Mar 23 '22 at 15:48
  • 2
    That's not going to be happening because the swap file is exclusively opened by the system, and can't be opened by other processes, so you can't copy it, whether through PowerShell or anything else. PowerShell being unable to list it is a curiosity; apparently it still needs to open the file in some way to fetch details, even if these are not normally displayed. It does know the file is there, it just can't get at it. Try `dir c:\ -Hidden` and then `dir c:\* -Hidden` to see what I mean. – Jeroen Mostert Mar 23 '22 at 15:53
  • @AbrahamZinala recieves `Could not find item` error and also lists the three `.sys` files – William Baker Morrison Mar 23 '22 at 15:58
  • `Get-ChildItem -LiteralPath c:\ -Filter *.sys -Force` works (unlike `Get-Item -LiteralPath c:\swapfile.sys -Force`) and checking permissions as `icacls.exe c:\swapfile.sys` returns _c:\swapfile.sys: The process cannot access the file because it is being used by another process._ – JosefZ Mar 23 '22 at 16:28

0 Answers0