The ViewState is maintained at page level and nainly keeps the values of controls of particular page in the client (browser) when post back operation done, although it can also be used to store other data. When user requests another page the data from the previous page is no longer available.
The Session keeps the data of particular user in the server, this data is available to all pages until user close the browser or session time completes.
In ViewState the the object are serialized and stored in hidden fields within the page. After the post back the server updates this field with the new set of values for which any older value is destroyed. In SessionState a part of the memory of the server for a particular client is used to store client specific data. This data are available till the session is active after the session is abandoned these data are deleted.