Which of the following best describes a memory forensics substitute described in the material?

• A. Pagefile and hibernation file only
• B. System registry and event logs
• C. Network captures and email attachments
• D. Video files and images

Answer: (A)

Memory contents can be lost when RAM isn’t captured, so investigators rely on disk-based artefacts that preserve in-memory data. The pagefile and the hibernation file are exactly that kind of substitute: pagefile.sys stores swapped-out memory pages, and hiberfil.sys contains a snapshot of RAM from when the system hibernates. Analyzing these files can reveal running processes, memory-resident keys, and other artifacts that were in volatile memory, making them the closest on-disk stand-ins for memory forensics.

Other options don’t fit this idea because the system registry and event logs capture configuration and events rather than the active in-memory state; network captures and email attachments are external communications data; and video files and images are media artifacts, not memory.