Hiberfil.sys
Definition
The compressed RAM snapshot Windows writes to C:\ when the system hibernates. Recoverable as a memory image with Hibr2Bin or Volatility, often containing process state from days or weeks earlier.
- Location
- C:\hiberfil.sys
- Content
- Compressed snapshot of RAM at hibernation
- Analysis tools
- Hibr2Bin, Volatility
- Forensic value
- Can hold process state from days or weeks earlier
Common questions
Why is hiberfil.sys valuable when a live RAM capture was not possible?+
If a machine was seized already powered off, volatile memory is gone, but if it had been hibernated at some point beforehand, the compressed snapshot preserves a slice of that earlier RAM state on disk, giving the examiner a substitute memory image to analyse.
Does every Windows machine have a usable hiberfil.sys file?+
No. The file only exists if hibernation was ever enabled and used, and modern fast-startup and hybrid-sleep configurations can produce partial or repeatedly overwritten snapshots, so an examiner should verify the file's presence and integrity before relying on it.
Related terms
- Alternate Data Stream (ADS)
- An NTFS feature that lets a file carry one or more named streams in addition to its default stream, accessed as filename.txt:streamname....
- File Slack
- The unused space at the tail of the last cluster of a file. It can contain remnants of whatever previously occupied that...
- LNK File
- A Windows shortcut that records the target path, target MAC times, the source volume serial number, and the MAC address of the...
- ShellBags
- Registry keys under Software\Microsoft\Windows\Shell\BagMRU and \Bags in UsrClass.dat and NTUSER.DAT that record every folder the user opened in Explorer, including folders on...
- Volume Shadow Copy (VSS)
- Block-level snapshots of NTFS volumes maintained by the Volume Shadow Copy Service for System Restore and backup. Recoverable with vss-tools, ShadowExplorer, KAPE,...