CCL’s Research & Development team explores how memory compression in Windows page files affects digital forensic investigations, and how decompression techniques can help recover valuable evidence that might otherwise remain hidden.
In this article, Arun Prasannan from our Research & Development team explores memory paging and compression, and the impact of compression on the examination of Windows page files.
It feels odd to be writing in 2026 about a file that the operating system uses when it runs out of RAM. Since the entire computer industry has decided recently to reorganise itself around the needs of 'AI' companies and large data centres, there isn't much RAM going spare for the rest of us, is there? Apparently 8 GB is all we need now to use Windows 11, there are lots of 4 GB phones around again, and GPU VRAM seems to be heading in a similar direction too. Perhaps page files are more relevant now than ever!
Even when there isn't a global supply shortage, physical memory (i.e. RAM) is a limited resource. For this and many other architectural reasons, modern operating systems implement several memory management features such as virtual memory. The region of memory that a running program can access (comprising program code as well as static and dynamically allocated data) is referred to as process memory. A particular location in memory is identified by a memory address, and the range of memory addresses that can be used by a process is its address space.
Each process running on the computer operates under the illusion that it has its own dedicated address space with a capacity that is independent of the total installed physical memory. When a process needs to access a location in memory it uses a virtual address, which then gets translated to a physical address for the corresponding location in physical memory. Virtual memory is broken into small, fixed-size units (of 4 KiB typically) called pages.
If the amount of physical memory available is insufficient, the operating system can relocate pages from RAM to disk, in other words paging them out to a page file (or a swap file/partition on Linux). Windows uses a file called pagefile.sys for this purpose, alongside swapfile.sys for Universal Windows Platform Apps (i.e. programs installed from the Microsoft Store), both located typically in the root of the C: drive (but the location can be changed by the user). Windows also uses pagefile.sys to store memory dumps after system crashes.
Recovering memory pages from disk is an inefficient process, so in order to reduce the amount of data written from memory to disk, modern operating systems can also implement compression of memory pages. Decompressing such pages stored in RAM is a faster process than restoring pages that were moved to secondary storage, because it avoids disk I/O. But compressed pages can end up in a page file eventually too.
Maxim Suhanov wrote about this in 2018 and explained that the Xpress (Plain LZ77) algorithm was used for memory compression in Windows 10. He also published a Python script which utilises a brute-force strategy to decompress pages from a page file or a memory dump. A brute-force approach is required because Windows maintains a map of where each compressed page resides, but that map is not available during a dead-box forensic examination. The script therefore attempts decompression of candidate regions within the file and then outputs valid results.
By 2024, it seems Windows switched to using the LZ4 algorithm to compress memory pages. Although not documented formally by Microsoft, this fact is reflected in the source code of MemProcFS (a popular memory analysis program) which implements LZ4 decompression for Windows 11 24H2 (build 26100) and later.
The page file can be a valuable source of evidence for a forensic examiner, as it could contain remnants of data that were once present in volatile memory. These could include fragments of files or artefacts relating to processes that were executed on the computer. But techniques such as keyword searching and file carving, which depend on finding contiguous sequences of raw bytes, are less effective when pages are compressed. Decompressing pages can reveal original data that would otherwise have remained hidden.
In this context, the compression algorithm used is a lightweight streaming compressor, designed to prioritise speed over achieving the smallest possible size. It works by identifying sequences of bytes which repeat and replacing the repetition with a backreference to the earlier occurrence. A keyword search may therefore yield some results, particularly on first occurrences within each block. Decompression will recover the original data, including sequences which were replaced by backreferences. In the image below, the snippet on the left-hand side shows a 512-byte region of compressed data within which the string 'Tier1' appears once; the snippet on the right-hand side shows the first 512 bytes of the result of decompressing that data – note how many more instances of 'Tier1' are present now.
Maxim Suhanov's script (winmem_decompress.py) can be used to extract memory pages compressed using the LZ77 algorithm which was used in earlier versions of Windows 10; winmem_decompress_lz4.py, published on CCL's GitHub site, replaces the LZ77 decompressor with an LZ4 decompressor (using the python-lz4 module), making it suitable for examining systems based on Windows 11 24H2 and later. Both scripts rely on a brute-force approach and are therefore slow, so a program such as Arsenal's Swap Recon which supports both formats is a more practical alternative for use in casework.
Our experts are on hand to learn about your organisation and suggest the best approach to meet your needs. Contact an expert today.
Get in touch
