Re: [Vol-users] hiberfil.sys

Aaron, You find it :) First 4096 bytes are zeroed out. Apologize I didn't check that before posting this mail. I tested your Great tool first with a Ram dump (built with mdd) and then wanted to try it on an hiberfil.sys extracted from an Encase capture. I will work a little bit more on this (to see how to access to the valuable data after this zeroed area) before joining the IRC Thanks :) Cordiales salutations - Bests regards Jean-François From: AAron Walters <awalters(a)4tphi.net> To: Jean-Francois Ragu/France/IBM@IBMFR Cc: vol-users(a)volatilityfoundation.org Date: 12/09/2008 17:34 Subject: Re: [Vol-users] hiberfil.sys Jean-Francois, Can you please clarify what you mean by a "dead system"? The real question is whether the system was hibernating when it "died". Can you do me a favor and open the file in a hex editor? Has the first page been zeroed out? In that instance, it needs a little extra processing but it can still be analyzed. As for Sandman, I don't think the public black hat released supported hiberfils that were not in use. Matthieu is a member of this list and would be able to confirm that. If you use IRC and want to discuss it more, you may also consider joining the #volatility channel where we all hang out. Thanks, AW On Fri, 12 Sep 2008, Jean-Francois Ragu wrote: to Sauf indication contraire ci-dessus:/ Unless stated otherwise above: Compagnie IBM France Siège Social : Tour Descartes, 2, avenue Gambetta, La Défense 5, 92400 Courbevoie RCS Nanterre 552 118 465 Forme Sociale : S.A.S. Capital Social : 542.737.118 euros SIREN/SIRET : 552 118 465 02430