When collecting evidence from the RAM, where do you look for data?

When collecting evidence from the RAM, where do you look for data?

• A. Swap file
• B. SAM file
• C. Data file
• D. Log file

Answer: (A)

When collecting evidence from RAM, you’re after data that was resident in volatile memory. If the system uses virtual memory, pages from RAM can be moved to disk in a swap file to free physical memory. Those swapped-out pages may still contain useful RAM-resident artifacts—strings, remnants of processes, or memory structures—that you can recover by examining the swap file. On Windows this is typically pagefile.sys, and Linux uses a swap area/file. So the swap file is the most likely place to find data that originated in RAM after it was paged out. The other options aren’t sources of RAM contents: the SAM file stores user account information, not RAM data; a generic data file isn’t specifically tied to memory artifacts; and a log file records events rather than actual memory pages.

When collecting evidence from RAM, you’re after data that was resident in volatile memory. If the system uses virtual memory, pages from RAM can be moved to disk in a swap file to free physical memory. Those swapped-out pages may still contain useful RAM-resident artifacts—strings, remnants of processes, or memory structures—that you can recover by examining the swap file. On Windows this is typically pagefile.sys, and Linux uses a swap area/file. So the swap file is the most likely place to find data that originated in RAM after it was paged out.

The other options aren’t sources of RAM contents: the SAM file stores user account information, not RAM data; a generic data file isn’t specifically tied to memory artifacts; and a log file records events rather than actual memory pages.