Back in the good old days, when Vista was just coming out, I produced a free tool called ATM. ATM poked around inside the kernel to figure out how your RAM was being used and produced a nice pretty graph (along with way too many numbers to understand). The purpose at the time was to look at how RAM was used for the system file cache. But it turned out to be great at showing what Superfetch was doing as well. Thanks to a hint in a blog by Alex Ionescu (the new guy on the Windows Internals 5th Edition book) I figured out how to get information on all 7 levels of Standby Cache and have updated the tool, which is now posted on my site at this link: www.tmurgent.com/Tool_ATM.aspx . Here is a snapshot:
Simply put, the green colors represent RAM that is actively in use, and the other colors represent “available memory”. Only the darkest blue color at the top is the zero and free memory pools. All those other colors represent the standby lists.
Vista and above use a seven layer standby list, as opposed to the single standby list in Windows XP, 2003, and before. Standby Lists are where memory goes that isn't (completely) in use right now, but contains contents that could be used under the right circumstances. For example, if a process has it's working set reduced, meaning that some of the process memory has been paged out to the pagefile on hard disk, that memory is initially deposited into a standby list. If the memory is needed, it can be repurposed immediately, but if the process page faults, the OS will find the old copy in memory and restore it to the process without having to go out to disk (a soft page fault as opposed to a hard page fault).
The other big example use of standby lists is on the Desktop versions of the OS where Superfetch is used. Superfetch watches your long term file access patterns, and attempts to predict which files you will need soon. It creates "scenarios", which when triggered, cause Superfetch to ask the system file cache to pre-read (on a low priority CPU thread using low priority I/O requests) the files it expects you to want. These files are placed directly into the Standby Lists until needed.
In the latest Windows Internals book, they describe how Superfetch produces both AM and PM scenarios. There are some major scenarios, such as logon and hibernation, but they hint to their being scenarios such as if it detects that if I launch program A, then I am likely to launch program B soon also.
Anyway, memory in these systems now have priorities, and the standby lists are ordered by these priorities. For example, if you leave the disk indexer enabled, file accesses by the indexer will be placed in lower priority memory and placed on the lower priority standby lists when released. Superfetch will use higher priority lists. When memory is needed by an application, the system will allocate from the zero and free memory lists first, and then start stealing from the lowest standby list with memory available.
The highest priority standby list, which I called "StaticPF" (the names for the standby lists shown in the tool are my own, we don't know what Microsoft calls them!) is a special pool. Here, Microsoft places files that it has determined should always remain in memory when not used unless pigs really do fly.
Anyway, take it for a spin!