I am running an application that just after starting, it creates a service (process hacker tool notifies me that driver_app.sys has been created). Indeed, it says that the location of driver_app.sys is:


My problem is that I would like to reverse such driver, but I do not manage to find a way to get the .sys file (I cannot find it anywhere while the app is running, and when it is closed the service stops and the .sys file disappears from the list displayed by process hacker). I am just asking how to do this since I have seen some people on the Internet analyzing this kind of files.

Thanks in advance.

  • Did you try showing hidden system files?
    – tmr232
    Commented Sep 24, 2016 at 22:47

1 Answer 1


There are some possible reasons for that behavior.

  1. As @tmr232 wrote you probably do not see an existing file because it is hidden. In this case enable "show hidden files" option in your file explorer.
  2. The file is created before the use and deleted after it. In this case I'd suggest to use one of 2 options: either try to run a script that always tries to copy this file if it exists, or try to trace the program file accesses with Process Monitor utility from sysinternals package - this will probably show you what exactly happens with the file.
  • OP specifically said he cannot find when the application is running, so I imagine #2 is not particularly helpful.
    – NirIzr
    Commented Sep 27, 2016 at 13:08
  • @NirIzr He says "I cannot find it anywhere while the app is running". As far as I understand he knows when it happens.
    – w s
    Commented Sep 28, 2016 at 11:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.