Pagefile
Pagefile
Auslagerungsdatei
The pagefile is an area on the data carrier into which Windows swaps out parts of memory when it becomes scarce. Forensically it is valuable because it can contain fragments of what was in RAM — even when the system has long been off. It is, in a sense, a permanent imprint of volatile data.
History & facts. If memory does not suffice, the operating system swaps memory pages onto the data carrier — into the pagefile. As a result, data fragments that are actually volatile can end up there: remnants of documents, input or even key-like data. Unlike pure memory, the pagefile survives shutdown and is part of the disk image — it thereby connects the world of persistent and of volatile traces.
Outlook & recommendation. For forensics, the pagefile is a complementary source to memory analysis: even if no live memory image could be taken, fragments of what was in RAM are sometimes found here. The contents, however, are unstructured and must be opened up with targeted search and carving methods. Those who want to remove data securely must not forget the pagefile — it too can contain sensitive remnants.