pagefile.sys and swapfile.sys

What it is

pagefile.sys is the Windows paging file: when physical memory runs short, the memory manager writes less-used pages of process and kernel memory to it. swapfile.sys, added in Windows 8, is used to swap out the whole working set of modern (Store/UWP) apps when they are suspended. Both are raw collections of 4 KB memory pages with no file-system structure or index. They survive a reboot (unless wiped at shutdown), which makes them a source of old memory content long after RAM has been cleared.

Location

Both files are hidden, system-protected and locked while Windows runs.

What it proves

• Any data that was once in memory may appear: command lines and script blocks, URLs and HTTP headers, chat fragments, e-mail addresses, file paths, registry fragments, pieces of executables and, sometimes, credentials or keys.
• Presence of an indicator (a C2 domain, a tool name, a PowerShell snippet) shows it was in memory at some point, which is useful when disk artifacts were deleted.
• It gives no reliable timeline: pages carry no timestamps and no link to the process that owned them.

Key fields

Timestamps

Retention and clearing

• Content is overwritten as the system pages, so older data survives only in slots that were not reused.
• ClearPageFileAtShutdown = 1 under ...\Session Manager\Memory Management makes Windows zero the paging file at shutdown (it slows shutdown and is rarely enabled). A pulled-plug or hard shutdown skips this.
• Windows 10 memory compression means a string search misses data held in compressed pages; tools that understand the compression format (research by FireEye/Mandiant on the compressed store) recover more.
• Disabling the paging file or resizing it can destroy the content.

Collection

• KAPE target: MemoryFiles (pagefile.sys, swapfile.sys, hiberfil.sys and minidumps; raw access for locked files)
• Velociraptor (Windows.Triage.Targets): MemoryFiles
• Built-in: the files cannot be copied with normal tools while Windows runs; use a raw NTFS collector, or take them from a disk image. Record the configuration:

reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v PagingFiles
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v ClearPageFileAtShutdown

Parsing tools

• bulk_extractor (open source): carves URLs, e-mail addresses, domains, credit-card numbers, JSON and more from raw data, with histograms.
• strings (Sysinternals, GNU): quick ASCII and UTF-16 extraction; search for indicators.
• YARA: scan the file with rules for tools, webshells or C2 configurations.
• Carving tools (PhotoRec, scalpel): recover embedded files such as images or documents.

Investigation tips

• Search for known indicators from the case (IP addresses, domains, file names, encoded PowerShell prefixes like JAB / SQBFAFgA) first; then review the context around each hit.
• Pagefile hits for a tool or domain that left no disk artifact support an anti-forensics narrative, but report them as "present in memory at an unknown time".
• Combine with hiberfil.sys and crash dumps for more complete memory evidence, and with a live RAM capture when available (order of volatility).
• Keep extracted credentials under strict handling rules.