Cisco
300-215 · Question #124
An investigator finds evidence erased from disk but suspects prior existence. Which artifact is MOST likely to retain evidence?
The correct answer is A. Page file (pagefile.sys). The page file may contain fragments of deleted data, memory artifacts, credentials, and command history not present elsewhere.
Submitted by marco_it· Mar 6, 2026Forensics Techniques
Question
An investigator finds evidence erased from disk but suspects prior existence. Which artifact is MOST likely to retain evidence?
Options
- APage file (pagefile.sys)
- BEvent Viewer cache
- CBrowser cookies
- DRecycle Bin index
How the community answered
(33 responses)- A73% (24)
- B3% (1)
- C9% (3)
- D15% (5)
Explanation
The page file may contain fragments of deleted data, memory artifacts, credentials, and command history not present elsewhere.
Topics
#Data recovery#Windows forensics#Page file#Deleted data
Community Discussion
No community discussion yet for this question.