Scenario

Use FILE IMAGE as the target device for data recovery imaging in DE. The initial LBA is changed in theimaging process. Then continue imaging. In some cases, available system memory loss or even suspended animation may occur.

Cause of the Problem

This is due to a system API function bug of Microsoft. The function name is FlushViewOfFile (). Under certain circumstances, calling this function may fail. Error code 33. The consequence is that data of system cache cannot be written to disk in time, causing the cache cannot be released. At the same time, memory usage of MRT application does not increase, and the available system memory will decrease. When calling this function frequently fails, the available system memory will decrease to zero and eventually cause suspended animation of system.

For detailed information, please refer to Microsoft official document:

http://support.microsoft.com/kb/2731284/en-us

Solutions

1. In Win7 or Windows Server 2008 R2 system, please download and install the patch file provided by Microsoft.

Download link:

http://hotfixv4.microsoft.com/Windows%207/Windows%20Server2008%20R2%20SP1/sp2/Fix405791/7600/free/451412_intl_i386_zip.exe

If the above download link fails, you can click on the link below to download from the MRT data recovery website:

http://info.mrtlab.com/download/KB2731284.rar

After extracting, the file name is Windows6.1-KB2731284-v3-x86.msu. Please restart the computer after the installation.

After patching, calling FlushViewOfFile () function failure will no longer cause decrease of available system memory.

Note: It is normal that there may be a pause of several minutes in the imaging process of DE. This is due to the blockage of function itself and there is an unknown system processing ongoing. Wait for a while, then the file image will continue automatically.

2. In XP or other systems, we suggest you not use FILE IMAGE as target device for imaging as Microsoft does not provide corresponding

If you need to conduct file image in this way, we suggest you not change the initial LBA arbitrarily or conduct reverse copy. Try to copy from the beginning to the end.

When imaging after changing the initial LBA, if you find the available system memory decreases continuously, please pause or stop the copy. Wait for 5 to 10 minutes, and then proceed. At this time, the system will automatically reclaim cache.