What file types can be used in place of a full memory image for memory forensics?

• A. Pagefile and hibernation file only
• B. JPEG files
• C. RAM dumps from any process
• D. Swap files

Answer: (A)

In memory forensics, you can substitute a full RAM image with disk-resident artifacts that preserve memory content. The two on-disk sources commonly used on Windows are the hibernation file and the pagefile. The hibernation file stores a complete memory image saved when the system hibernates, so analyzing it can reveal what was in RAM at that time. The pagefile contains pages swapped out to disk during operation, which can include code, data, and artifact remnants from running processes, providing substantial memory context. RAM dumps from a single process don’t reflect the entire system’s memory, so they aren’t a full substitute for a memory image. JPEG files are unrelated to volatile memory content. Swap files exist in some OSes, but the standard on-disk substitutes for Windows memory forensic analysis are the pagefile and the hibernation file, making them the best fit in this context.