The steps to extract web browser data from Pagefile.sys are as follows:
- Start by creating a new case in Belkasoft Evidence Center - you already know how to do this. Then, add the pagefile.sys file you exported previously as the evidence source.
Figure 8.9. Adding pagefile.sys as the evidence source
- As we are planning to extract web browser artifacts and are dealing with a Windows system, let's choose corresponding data types, as in the following figure:
Figure 8.10. Choosing data types
- Click Finish and the processing will start. Once the processing phase has finished, go to the Overview tab and check the results.
Figure 8.11. Processing results
As you can see in the preceding figure, we have 2289 URLs extracted from pagefile.sys! Impressive, isn't it? You can do the same with two other files: swapfile.sys and hiberfil.sys.