On the Forensics of Pagefile.sys in Windows Systems

Memory forensics is key in today's digital investigations, with threats like fileless malware rising. Windows pagefile.sys, part of virtual memory, is a goldmine of forensic data. This paper looks at the history of pagefile.sys forensics, from early days to cutting-edge methods. This paper reviewed some important relevant and previous research that has affected this topic, besides the tools for acquiring and analyzing pagefiles. The paper also reviews the process of connecting data of the pagefile with memory dumps and tries to discover how long data can be obtained in pagefiles. In this research, we will be able to extract valuable evidence from pagefile.sys by figuring out how to reconstruct the virtual memory for paged-out processes, and this will happen after a deep understanding of the structure and the content of pagefile.sys. However, despite challenges that exist in the new versions of Windows (10 and 11), this paper discusses this matter and tries to propose some ideas for future research directions.