pagefile.sys vs hiberfil.sys vs swapfile.sys: which Windows paging file to analyze

Show hidden + system files at the root of a Windows volume and you usually get three large files staring back: pagefile.sys, hiberfil.sys, swapfile.sys. New analysts treat them as interchangeable "memory things". They are not. Each one holds different data, gets written under different conditions, and has a different forensic ceiling.

File	Default size	What it holds	When written
`pagefile.sys`	~1.5x to 3x RAM	Anonymous paged-out memory, raw 4 KB pages	Continuously, on memory pressure
`hiberfil.sys`	~RAM size	Full RAM snapshot, Xpress-compressed	On hibernate / Fast Startup shutdown
`swapfile.sys`	16 MB to 16 GB	UWP / Modern app working sets	When UWP apps are suspended

pagefile.sys

This is the file most people mean when they say "the page file". The Memory Manager picks a cold anonymous page (a heap allocation, a stack page, a JIT region), writes it to pagefile.sys, and frees the RAM frame. The next time something touches that virtual address, the page faults back in.

Content: raw 4 KB frames, no order, no header, no per-page metadata.
Forensic value: high. Anything that lived in a process address space and was not pinned can land here. PE sections, registry hive bins, MFT records, browser SQLite pages, command lines, plaintext credentials.
Tools: bulk_extractor, page_brute, photorec, scalpel for raw carves. This parser does the same in the browser without uploading the file.
Catch: pages are non-sequential and on Windows 10+ are frequently Xpress-Huffman compressed by CompressionStoreManager before they reach disk. See the limitations post for the consequences.

The configured paths and sizes are governed by HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PagingFiles. Read this key before you trust a default-path assumption. On servers I have seen pagefile redirected to a separate spindle that was never acquired.

hiberfil.sys

Written when the system hibernates, or when it shuts down with Fast Startup enabled (which is a hybrid hibernation in disguise). The file is essentially a full snapshot of physical RAM at the moment of hibernate, compressed with Microsoft's Xpress algorithm and prefixed by a PO_MEMORY_IMAGE header. The signature at the start is HIBR or WAKE.

Content: most of the contents of RAM, including PFN tables, EPROCESS structures, kernel pools. The same material a live RAM dump would give you.
Forensic value: enormous when present. Volatility walks it natively. You get full process listings, network state, registry-in-memory, LSA secrets, LSASS material.
Tools: volatility3 -f hiberfil.sys. The older hibr2bin converter from the Volatility ecosystem still works if you need a raw image. Do not treat hiberfil.sys as a pagefile-style carve target. Its structure is documented and Volatility speaks it.
Catch: it only exists if the machine hibernated, slept with Fast Startup, or used hybrid sleep. A machine that was rebooted cold either has no hiberfil.sys or has one from a previous hibernate cycle. Check the file mtime before you trust the contents.

swapfile.sys

Introduced with Windows 8 alongside UWP / Modern apps. Where pagefile.sys pages individual 4 KB frames on demand, swapfile.sys suspends entire app working sets wholesale when a UWP process is backgrounded.

Content: working sets of suspended UWP apps. Modern Edge (the older UWP build), Mail, Photos, Calendar, Store, Cortana, Maps, Modern Office.
Forensic value: niche but real. UWP browsers and mail clients sometimes leave fragments here that never reached pagefile.sys. Worth grabbing.
Tools: same carving as pagefile. Magic-byte signatures, strings, regex sweeps.
Catch: small, typically a few hundred MB. On hosts with no UWP usage it is mostly empty.

Which to grab during an incident

Grab all three if you can. They are cheap to copy and each yields a different evidence set. If you have to pick:

hiberfil.sys first when it exists with a non-trivial size. A full RAM snapshot dwarfs anything you will pull out of pagefile carving.
pagefile.sys for the bulk of paged-out anonymous memory.
swapfile.sys when you are chasing a UWP-specific artifact (modern Edge tabs, Mail attachments).

In practice KAPE with --target MemoryFiles pulls all three plus minidumps from C: in one pass.

Detecting Fast Startup

A Windows that "shut down" cleanly may have hibernated under Fast Startup, which means there is a hiberfil.sys worth more than the rest of the disk. Tells:

hiberfil.sys exists with a size close to installed RAM.
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power\HiberbootEnabled = 1.
The EVTX channel Microsoft-Windows-Kernel-Power%4Operational.evtx shows a hybrid-sleep transition rather than a clean shutdown.

If you see Fast Startup signs, capture hiberfil.sys before doing anything else. A normal boot will overwrite it with the next session.

After acquisition

See how to acquire pagefile.sys for the capture mechanics, and how pagefile.sys forensics actually works for what carving looks like in practice.