An analyst needs to identify the applications a user was running and the files that were open before the user’s computer was shut off by holding down the power button. Which of the following would MOST likely contain that information?
A. NGFW
B. Pagefile
C. NetFlow
D. RAM
B
It would most likely be contained in the pagefile.
Answer : B
Answer is B
D is right
Ram doesn’t retain any information after being shut off