Hiberfil.sys
Definition
The compressed RAM snapshot Windows writes to C:\ when the system hibernates. Recoverable as a memory image with Hibr2Bin or Volatility, often containing process state from days or weeks earlier.
Related terms
- Alternate Data Stream (ADS)
- An NTFS feature that lets a file carry one or more named streams in addition to its default stream, accessed as filename.txt:streamname....
- File Slack
- The unused space at the tail of the last cluster of a file. It can contain remnants of whatever previously occupied that...
- LNK File
- A Windows shortcut that records the target path, target MAC times, the source volume serial number, and the MAC address of the...
- ShellBags
- Registry keys under Software\Microsoft\Windows\Shell\BagMRU and \Bags in UsrClass.dat and NTUSER.DAT that record every folder the user opened in Explorer, including folders on...
- Volume Shadow Copy (VSS)
- Block-level snapshots of NTFS volumes maintained by the Volume Shadow Copy Service for System Restore and backup. Recoverable with vss-tools, ShadowExplorer, KAPE,...
Explained in
- Windows Artifacts II: ShellBags, ADS, LNK, Hibernation, SlackThe compressed RAM snapshot Windows writes to C:\ when the system hibernates. Recoverable as a memory image with Hibr2Bin or Volatility, often containing proce...