An analyst needs to identify the applications a user was running and the files that were open before the user's computer was shut off by holding down the power button. Which of the following would MOST likely contain that information?
A) NGFW
B) Pagefile
C) NetFlow
D) RAM

Question

Quizplus · Accepted Answer

The pagefile is a hidden file on a computer's hard drive that is used to store data that does not fit in the computer's RAM. When a computer is shut down by holding down the power button, the data in RAM is lost. However, the data in the pagefile is not lost, so it can be used to identify the applications that were running and the files that were open before the computer was shut down.

An Analyst Needs to Identify the Applications a User Was