While an original file is crucial to any work process, recovering it, especially from a Swap file, can not only be a complex endeavor but equally challenging in and of itself. And further adding to the insult is the fact that there are no guarantees whether such a recovery will be complete or not. Despite all this, we have described a general outline regarding what happens when you try to recover an original file from a .swp one. The recovery will completely depend on your luck, but still worth a try if the data is that important to you.
What is a Swap file?
A Swap is a virtual memory file used by an OS such as Linux or Windows to hold temporary data not currently in use by the system’s RAM. Thus, a Swap file gets used when the RAM space is insufficient to run applications on a system. Hence, a Swap file creates temporary storage on a hard disk when the memory runs low. Usually, these files are created by the text editors such as Vim especially while working with large documents.
When the computer uses a Swap file, it interchanges a section of the RAM with an idle program. Doing so frees memory space for other priority programs. Hence, a Swap file allows users to run more programs than the amount limited by the RAM.
And since it is virtual, it doesn’t take up any space on the RAM. However, the implementation of Swap files differs with different operating systems. But that topic is for another day.
Note – Swap files are also known as page files, swap space, or paging files. And they remain hidden on the system by default.
Recovering an original file from a Swap file – General Process:
As we have mentioned in the beginning, recovering an original file from a Swap is altogether an uphill battle. It is difficult and a time-consuming process. On top of that, the system doesn’t even guarantee that it would work. Thus, we recommend regularly backing up your important files to prevent data loss, as it is much more helpful than relying on a Swap dependent recovery.
But for now, let us delve into the recovery process and describe what happens when a file gets stored in a Swap, and then gets recovered.
The Recovery Process:
First off, when a typical file gets transferred to a Swap file, it gets broken into small pieces (pages). The storage is the file’s page cache. Then, when the user initiates the file recovery, the OS gathers all those split pages back to the memory, where it reassembles the original file.
Pretty simple, right? But an equally dangerous method as even a single missing page can render the original file corrupt. Hence, the greater odds of it not working.
It brings us to the next step, and that is, the location of the Swap file. Recovery is only possible if we remember where the Swap file currently is. Once you have determined the exact location of the Swap file, it’s time to extract its contents using third-party applications such as Volatility or Foremost.
The application will scan and analyze the memory image of the Swap file to extract information. And once the extraction is done, users can search for the original file using yet another file reader software. But to reiterate, this process can last a bit longer and requires some trial and error to work out.
Recover .swp file with Vim
Vim is one of the tools that store info in a .swp file. This can be recovered if you meet one of the following criteria.
If you have access to the original file
If you want to recover your file using Vim, and have access to the original file, it is pretty easy to do so. While there are multiple ways you can accomplish this, the easiest one is just opening the original file using Vim. The tool will automatically recognize that there is a .swp file associated with it and provide you with an option to recover it.
If you just have the .swp file
If you do not have the original file, try recovery using the following command to try to recover the original file from the .swp file.
vim -r .swpOnce you recovered the file, you can save it as a normal file.
