During a forensic investigation of a compromised Windows system, Investigator Sarah is tasked with extracting artifacts related to the system's pagefile.sys. She needs to navigate through the…

Question

Options

• AHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
• BHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Windows
• CHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerN
• DHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory

• A
  4% (2)
• B
  4% (2)
• C
  9% (4)
• D
  83% (38)

Explanation

According to the CHFI v11 Operating System Forensics module, the Windows pagefile.sys is a critical forensic artifact because it serves as virtual memory and may contain remnants of sensitive data such as credentials, command history, decrypted content, fragments of documents, and even portions of malicious code that were previously resident in RAM. As a result, understanding where pagefile-related configuration data is stored in the Windows Registry is essential for forensic investigators. The registry path HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management is the correct location where Windows stores configuration values related to virtual memory management, including the PagingFiles value. This value specifies the location, size, and behavior of the pagefile.sys on the system. CHFI v11 explicitly references this registry key when discussing memory artifacts, virtual memory analysis, and Windows memory forensics.

No community discussion yet for this question.