What is a Swap File?
The Windows Swap File is space on a hard disk reserved for the operating system to do what’s called paging. When physical memory runs out, Windows takes the oldest unused pages (each page consists of data) from memory and moves it to virtual memory. This process is called swapping, hence the name “swap file”.The swap file is essentially a single large file containing a huge amount of data. The swap file is important when conducting computer forensic investigations since a large volume of data can exist within the swap file, which the computer user has no knowledge of. This data is typically temporary and whenever a computer is run, the potential exists in the Windows Swap File to be overwritten. TMD ensures through sound forensic procedures that this data (if present) is located and searched for evidence pertinent to a given investigation or case.
