According to theCHFI v11 Operating System Forensicsmodule, the Windowspagefile.sysis a critical forensic artifact because it serves as virtual memory and may contain remnants of sensitive data such as credentials, command history, decrypted content, fragments of documents, and even portions of malicious code that were previously resident in RAM. As a result, understanding where pagefile-related configuration data is stored in the Windows Registry is essential for forensic investigators.
The registry path
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
is the correct location where Windows stores configuration values related tovirtual memory management, including thePagingFilesvalue. This value specifies the location, size, and behavior of the pagefile.sys on the system. CHFI v11 explicitly references this registry key when discussingmemory artifacts, virtual memory analysis, and Windows memory forensics.
The other options are not relevant to pagefile analysis. TheCurrentVersionkey stores OS version details,ControlSet001\Control\Windowscontains general system control settings, andActiveComputerNameonly identifies the system hostname. None of these paths contain pagefile configuration data.
Therefore, to extract and validate artifacts related topagefile.sys, Investigator Sarah must examine
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management, makingOption Dthe correct and CHFI v11–verified answer.
