1

I have a process which writes something in file, see below for an example. Is there any way to show me what was written in file with this event? thanks.

Example of process monitor write action:

enter image description here

4
  • As it is a .log file it's likely a text file. Open it with your favorite text editor and have a look.
    – Seth
    Feb 1, 2017 at 12:41
  • Yes, its text, but as I mentioned in question I need the data that was written with this particular event.
    – Rasty
    Feb 1, 2017 at 12:46
  • 1
    You really couldn't haven taken a less illegible screenshot. But as far as I can see at the end of it you get an offset and a length for the log file. So you know at what point and how much data was written into that file. It's likely that the length is in byte and as an ASCII file would have 1 byte per character you just need to discard the first offset number characters and read the length characters after that to get what was written. Assuming the content in that place didn't change.
    – Seth
    Feb 1, 2017 at 12:59
  • thanks for the answer :) is there anyway to do this by terminal(cygwin) instead of manually counting characters?
    – Rasty
    Feb 1, 2017 at 13:14

1 Answer 1

0

That line in your screenshots contains various bits of information. Among them are an offset and a length. It's likely that they represent the amount of data (length) that was written into that file at a specific position (offset).

As it is a log file, I'd assume its an ASCII file. In that case each character would have one byte and it's likely that the offset and length are given in byte. As such you would just have to jump to the number character and read the following number of characters to get what was written to that file.

There are various approaches to do this and they would depend on the kinds of tools you use. You could use the Linux tool that are available through cygwin, the PowerShell, some editor that allows you to jump to a specific location or another tool altogether. So yes, you could automate it.

The easiest approach would probably to read the first amount of characters, discard them and then read the next amount of characters and output them.

The specifics on how to do this would depend on the tools you use and it should be easy to find a solution using your favorite search engine.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .