Exam 312-49v10 topic 1 question 248 discussion

The correct answer is D. Hidden running processes. Virtual memory (also known as page file or swap space) is a area on the hard drive where the operating system stores data that is currently not in physical RAM (Random Access Memory). When a computer runs low on physical RAM, the operating system moves inactive pages of memory to the virtual memory to free up physical RAM for other uses. By scanning the virtual memory, John may be able to find evidence of hidden running processes, such as malware or botnet software, that were not visible in the physical RAM. This is because the virtual memory may contain remnants of processes that were previously running but are now closed, or processes that are designed to evade detection by hiding in the virtual memory.