This question aligns with CHFI v11 objectives under Operating System Forensics and Volatile and Non-Volatile Data Analysis, particularly the recovery of artifacts from live memory and system files such as pagefile.sys. Private browsing modes (e.g., InPrivate, Incognito) are designed to minimize persistent artifacts on disk; however, CHFI v11 emphasizes that memory, page files, and swap files often retain remnants of browsing activity, including URLs, session data, cached content, and credentials.
FTK Imager is a forensically sound tool widely used for live data acquisition, memory capture, and analysis of volatile artifacts. It allows investigators to acquire RAM, pagefile.sys, hiberfil.sys, and other critical system files without altering evidence integrity. CHFI v11 specifically highlights FTK Imager as a preferred tool for collecting and examining live system data and recovering artifacts that are not available through traditional disk-only analysis.
PsLoggedOn is used to identify logged-in users, Exeinfo analyzes executable file formats, and zsteg is a steganography detection tool. None of these are suitable for live memory or pagefile analysis. Therefore, consistent with CHFI v11 forensic best practices, FTK Imager is the correct tool to recover private browsing artifacts from live Windows systems.