Various thoughts and projects that grab my attention for more than a few minutes. Problem: Given a pagefile.sys, how much information can you gain about the victim? Hints: The pagefile.sys is stored as a bunch of 4k blocks. It is "virtual memory". strings pagefile.sys | grep -i "^[a-z]:\\\\" | sort | uniq | less #List all paths in pagefile NOTE: You could find a lot of paths referencing "d:\nt\bas