https://www.pagefilesysparser.com/en/blog Guides and field notes on Windows pagefile.sys forensics, acquisition, and analysis. en Tue, 26 May 2026 18:32:32 GMT https://www.pagefilesysparser.com/en/blog/carving-registry-hives-from-pagefile https://www.pagefilesysparser.com/en/blog/carving-registry-hives-from-pagefile How to identify regf and hbin blocks in a Windows pagefile, what you can recover from them, and how to chain the output into RegRipper / hivexsh / Eric Zimmerman's Registry Explorer. Pagefile.sys Parser Wed, 20 May 2026 00:00:00 GMT https://www.pagefilesysparser.com/en/blog/detecting-malware-command-lines-in-pagefile https://www.pagefilesysparser.com/en/blog/detecting-malware-command-lines-in-pagefile PowerShell encoded commands, certutil downloads, mshta payloads, rundll32 abuse, regsvr32 squiblydoo — the command-line patterns that show up in Windows pagefile.sys and how to find them. Pagefile.sys Parser Wed, 20 May 2026 00:00:00 GMT https://www.pagefilesysparser.com/en/blog/encrypting-pagefile-sys https://www.pagefilesysparser.com/en/blog/encrypting-pagefile-sys Windows can encrypt pagefile.sys with a per-boot ephemeral key. This post explains what that protects against, what it doesn't, how it interacts with BitLocker, and what it means for forensic analysis. Pagefile.sys Parser Wed, 20 May 2026 00:00:00 GMT https://www.pagefilesysparser.com/en/blog/finding-credentials-in-pagefile-sys https://www.pagefilesysparser.com/en/blog/finding-credentials-in-pagefile-sys Why credentials leak into Windows pagefile.sys, what shapes to look for — passwords, bearer tokens, JWTs, NTLM, Kerberos, cloud CLI tokens — and how this parser surfaces them. Pagefile.sys Parser Wed, 20 May 2026 00:00:00 GMT https://www.pagefilesysparser.com/en/blog/how-to-acquire-pagefile-sys https://www.pagefilesysparser.com/en/blog/how-to-acquire-pagefile-sys Practical acquisition methods for Windows pagefile.sys — live, offline, from disk images and VM snapshots, with the pitfalls to avoid. Pagefile.sys Parser Wed, 20 May 2026 00:00:00 GMT https://www.pagefilesysparser.com/en/blog/limitations-of-pagefile-analysis https://www.pagefilesysparser.com/en/blog/limitations-of-pagefile-analysis What you can and cannot recover from a Windows pagefile — and why Windows 10's memory compression changes the calculus. Pagefile.sys Parser Wed, 20 May 2026 00:00:00 GMT https://www.pagefilesysparser.com/en/blog/pagefile-forensics-techniques https://www.pagefilesysparser.com/en/blog/pagefile-forensics-techniques Signature carving, string extraction, and entropy analysis — the three techniques that drive every pagefile.sys analysis tool. Pagefile.sys Parser Wed, 20 May 2026 00:00:00 GMT https://www.pagefilesysparser.com/en/blog/pagefile-vs-hiberfile-vs-swapfile https://www.pagefilesysparser.com/en/blog/pagefile-vs-hiberfile-vs-swapfile Windows has three paging-related files at the root of the system drive — pagefile.sys, hiberfil.sys, swapfile.sys. Each contains different data and matters at different points in an investigation. Pagefile.sys Parser Wed, 20 May 2026 00:00:00 GMT https://www.pagefilesysparser.com/en/blog/recovering-browser-history-from-pagefile https://www.pagefilesysparser.com/en/blog/recovering-browser-history-from-pagefile How Chrome, Edge and Firefox leak browsing data into Windows pagefile.sys — and how to extract URLs, cookies, search queries and autofill values from a carved page. Pagefile.sys Parser Wed, 20 May 2026 00:00:00 GMT https://www.pagefilesysparser.com/en/blog/should-you-delete-pagefile-sys https://www.pagefilesysparser.com/en/blog/should-you-delete-pagefile-sys Disabling pagefile.sys frees disk space and can be a security hardening step — but it also reduces performance and breaks crash dumps. Here's a forensic and operational view of when (not) to do it. Pagefile.sys Parser Wed, 20 May 2026 00:00:00 GMT https://www.pagefilesysparser.com/en/blog/volatility-and-pagefile-sys-workflow https://www.pagefilesysparser.com/en/blog/volatility-and-pagefile-sys-workflow Volatility cannot parse pagefile.sys standalone — but paired with a RAM dump, it can reconstruct the full virtual address space, including paged-out pages. Here's the workflow. Pagefile.sys Parser Wed, 20 May 2026 00:00:00 GMT https://www.pagefilesysparser.com/en/blog/what-is-pagefile-sys https://www.pagefilesysparser.com/en/blog/what-is-pagefile-sys A short tour of Windows' pagefile.sys — why it exists, what's inside, and why forensic analysts care. Pagefile.sys Parser Wed, 20 May 2026 00:00:00 GMT