Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm trying to troubleshoot a program that seems to fail when saving files. Using ProcMon from SysInternals I was able to determine that it writes a log file somewhere, but right after it fails, it deletes it. So, it all happens in milliseconds and I can't get to see the file.

Is there anything for Windows that would allow me to see the actual data written to the files? I tried DiskMon but does not show data as well.

EDIT: The specifics of the program I am trying to work with is SAI (Easy Paint Tool), trying to troubleshoot some saving issues.

share|improve this question
    
is it a text log file or something else? –  Journeyman Geek Jun 3 '12 at 15:02
    
@JourneymanGeek Yes, it is a text log this program generates. Seems to be XML as well. (I've only been able to recover parts of it and found mixed stuff -- probably from the recovery itself) –  Alpha Jun 3 '12 at 15:32
1  
Idea (no time to formulate into a full answer, and not sure it'll work): create the log file manually beforehand, then deny yourself (or whatever user the program runs as) delete permissions on the file. Ideally it'll just append its data to the file, then fail to delete it, but it might also fail to write at all because the file already exists, or decide to write to a different file instead. –  Indrek Jun 3 '12 at 15:42
1  
You could attach a debugger and step through to the file write, then normally open up the file, read it before it gets deleted. –  HackToHell Jun 3 '12 at 15:54
add comment

1 Answer

If the log is present while the program is running normally, and the drive it's on is NTFS, create a hardlink to the log. (If you have nothing else, a hardlink can be created using fsutil on XP or mklink on Vista+.)

share|improve this answer
    
I can't do that beforehand, right? The log is created at the moment I start the sae action, and the log is deleted at the moment that fails (does not make sense to me). I only have milliseconds where the file is actually there. –  Alpha Jun 3 '12 at 15:00
    
Doesn't make sense to me either, which is why I couldn't believe it. :) Can't really think of anything simple, but at an extreme, I could patch ANSICON so it would log all WriteFile data (not just console). What's the program? –  adoxa Jun 3 '12 at 15:07
    
It's sai.exe, the executable file for SAI, an image edition program. Turns out that it can open PSD (Photoshop) files but suddenly started failing when saving those it its own format. I'm trying to troubleshoot that and found that it creates the destination file with a temp name, then a log file in ProgramData and then deletes both. –  Alpha Jun 3 '12 at 15:10
1  
If it's version 1.1.0, use a hex editor (or something) to search for 1C D1 4B 00 and replace with 24 D1 4B 00 - that replaces the delete function with another. –  adoxa Jun 3 '12 at 16:16
    
Thanks, I'll give it a try and report results. What should this new function do? –  Alpha Jun 4 '12 at 13:28
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.