When collecting evidence from the RAM, where do you look for data?

The correct answer is A. Swap file. When the operating system runs low on physical RAM, it pages (moves) memory contents to the swap file (also called the page file or pagefile.sys on Windows). This means volatile data that was in RAM - such as encryption keys, passwords, and running process data - may be…

Submitted by hassan_iq· Apr 18, 2026Computer Forensics Investigation Process

Question

Options

ASwap file
BSAM file
CData file
DLog file

How the community answered

(27 responses)

A
85% (23)
B
4% (1)
C
7% (2)
D
4% (1)

Explanation

When the operating system runs low on physical RAM, it pages (moves) memory contents to the swap file (also called the page file or pagefile.sys on Windows). This means volatile data that was in RAM - such as encryption keys, passwords, and running process data - may be preserved in the swap file even after a system is powered down. Forensic investigators examine the swap file to recover data that was once resident in RAM. The SAM file stores user credentials, while data and log files serve different purposes.

Topics

#Memory Forensics#RAM Acquisition#Volatile Data#Swap File

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice