Swap Recon

Swap Recon performs brute-force decompression of Windows 10 and 11 swap (e.g. pagefile.sys and swapfile.sys). Swap Recon was built when we could not find any tools or techniques to decompress modern Windows swap both comprehensively and usefully in one of our highest-stakes cases. Please note that Swap Recon processing is extremely computationally time intensive, and we recommend running it on the most powerful hardware you have available to you - ideally on Amazon EC2 (Elastic Compute Cloud).

Swap Recon run against sample swap chunk from Defcon DFIR CTF 2019

1 Year Plan
$756
~ $63/mo | Save 3%
    • Email Support

    • Purchase Annually

    • Locked-in Discount

3 Year Plan

$2,129

~ $59/mo | Save 9%

5 Year Plan

$3,315

~ $55/mo | Save 15%

Prices shown in USD and without tax.