I'm trying to find some info on artefacts created from a user pressing 'print screen' on a Win7 system, without the action of paste afterwards.
I'm assuming lost with RAM, possibly partially stored in sys vol. Thoughts?
Thanks in advance,
I'm trying to find some info on artefacts created from a user pressing 'print screen' on a Win7 system, without the action of paste afterwards.
I'm assuming lost with RAM, possibly partially stored in sys vol. Thoughts?
Thanks in advance,
What happens is simply that a whole screen bitmap is stored in the clipboard, so it is "volatile" by definition (and overwritten at next Ctrl+C or Copy comand in almost *any* application) AFAIK.
I don't think that anything changed in 7.
You can play a bit with this
http//
jaclaz
Thanks jaclaz. So I'm guessing you 'could' potentially get the bitmap from hybersys, if your lucky…
I would assume that it keeps it in memory as a bitmap, and since the size of the screen can be quite large, this is potentially a very large amount of RAM being used so it is conceivable that it might be swapped out to the pagefile quite quickly. Goodness knows how fragmented it would be though.