Which of the following is a common source within a system that can retain data before it is swapped in memory?

• A. Swap file
• B. SAM file
• C. Data file
• D. Log file

Answer: (A)

When a system uses virtual memory, the operating system moves memory pages out to a disk-based swap file when RAM is full. Those pages on disk can contain data that was just in memory, including contents of documents or sensitive information, and they stay there until swapped back in. Because the swap file holds this memory-resident data, it’s a common forensic source for recovering what was in RAM before it was swapped in again. The other options relate to separate data stores: the SAM file contains user account information, a data file is a generic data container, and a log file records events. None of these specifically preserve memory contents as the swap file does.