pagefile.sys.

The Windows virtual-memory swap file on the system volume that can contain fragments of process memory, including credentials, keys, command lines, and decrypted payloads. It belongs to the Forensics & IR category of cybersecurity.

The Windows virtual-memory swap file on the system volume that can contain fragments of process memory, including credentials, keys, command lines, and decrypted payloads.

pagefile.sys is the on-disk backing store for Windows virtual memory, typically located at the volume root and sized dynamically by the system. When physical RAM is under pressure, the memory manager writes paged-out pages from user and kernel address spaces to the pagefile, where they can persist for days or weeks. Forensically, the pagefile is unstructured but rich: string carving and signature-based searches frequently recover plaintext credentials, PowerShell command lines, decrypted malware payloads, fragments of HTTP traffic, and registry hive snippets. Volatility's pagefile-aware plugins, bulk_extractor, and yarscan against the raw file can surface evidence that exists nowhere else on disk. Some configurations also encrypt or clear it at shutdown.

Defences for pagefile.sys typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Page file, Windows swap.