Which artifact can be used in place of a full memory image for memory forensics?

• A. Pagefile and hibernation file only
• B. Pagefile and system log
• C. Hibernation file and RAM dump
• D. Pagefile and picture files

Answer: (A)

In memory forensics, when you can’t capture a full RAM image, certain on-disk artifacts can stand in for memory content. The hibernation file (hiberfil.sys) stores a complete snapshot of RAM at the moment the system enters hibernation, so it effectively provides a memory image on disk. The pagefile (pagefile.sys) contains swapped-out memory pages, which can reveal data that was resident in RAM and even reconstruct what processes were doing, what data they touched, and other artifacts.

Using both together gives you the strongest approximation of volatile memory: the hibernation file provides a near-full RAM snapshot, while the pagefile adds additional swapped data that can fill gaps and recover more artifacts. Other options like system logs, isolated RAM dumps, or unrelated picture files don’t capture memory contents in the same way, so they’re not as effective as a substitute for a full memory image.