Where does a hex editor store retrieved hard drive data?

[krayzeeben]

I've been using the HxD hex editor by Mael Horz and recently learned about its ability to display the contents of my entire hard drive(about 1 terabyte). My assumption is that all this data retrieved from the hard drive must be kept in RAM first, and then it can be displayed onto the screen. Since my RAM is only 4 gigabytes, I am confused as to how my 1 terabyte of hard drive contents can be outputted to my monitor screen. My guess is that not all is outputted at once because there is a scroll bar to scroll down the list, but still the contents are displayed extremely quickly.

So what i'd like to know is, does data(the exact binary) need to be kept in RAM in order to be displayed onto the screen?

[sepp2k]

Depending on your operating system data will be moved from your RAM into a swap file or partition once your RAM is full.

That said there is no way that your hex editor reads your whole hard drive into memory before displaying it. Not only would reading such large amount of data take an awful lot of time, there's no way you could fit into all into memory - even with swap files (there is usually a maximum size for swap files and even if there weren't, it would be limited by available disk space).

As you said, only a small portion of the data is displayed at any given time, so it'd be easy for the editor to only read a small portion of the data and then load further portions (and possibly unload old portions) as you scroll down.

[krayzeeben]

Thanks for confirming my prediction. My operating system is windows 7.

So in order to display data onto the screen, data must go into the RAM first? And if the RAM is out of space, then it stores temporary data onto the hard drive as swap files?

Since it is storing data onto the hard drive, is there a chance that it will overwrite old data(such as deleted files)? And when data is being stored from RAM as a swap file, is the data always stored in the same sector(s) on the hard drive, or is the address location dynamic as in it might not always be in the same location?

I'm trying to create a data recovery program and i'm worried that there will be significant data loss every time I read the entire hard drive.

So would it be dangerous to be reading the hard drive with a hex editor if I use a laptop (windows xp) that only has 2gigabytes RAM and 80 gigabytes hard drive?

[sepp2k]

So in order to display data onto the screen, data must go into the RAM first?

Generally yes. But as I said that doesn't mean that the whole file must be in memory at once. That wouldn't even be possible in this case.

And if the RAM is out of space, then it stores temporary data onto the hard drive as swap files?

Yes, but again that's not what's happening in this case. Trying to read the whole hard drive into memory at once would crash the program - swap file or not.

Since it is storing data onto the hard drive, is there a chance that it will overwrite old data(such as deleted files)?

Yes, writing new things to a hard drive always has the chance of overwriting deleted files (but again note that you can't read the whole hard drive into memory at once and reading only parts of it at a time will likely not involve any swapping).

And when data is being stored from RAM as a swap file, is the data always stored in the same sector(s) on the hard drive, or is the address location dynamic as in it might not always be in the same location?

I'd assume it would be placed just like any other file. But I really don't know anything about how Windows handles swap files.

I'm trying to create a data recovery program and i'm worried that there will be significant data loss every time I read the entire hard drive.

If you try to read the whole hard drive into memory at once, the most likely outcome will be that your program will simply crash (though possibly only after a swap file has been created).

If you read the hard drive chunk-by-chunk with small enough chunks, there's no reason to assume that any swapping or data loss would happen.