“In a case with many Windows OS based computers, I successfully used Swap Recon on pagefile.sys files to extract history for visited .onion sites as well as credentials for some sites, commands that had been run in the prompt, and a lot of good candidates for password attacks. I was only able to extract this valuable data from decompressed blocks of swap produced by Swap Recon, not from the raw swap (pagefile.sys) files.”