Re: [Vol-users] Analyzing a hiberfil.sys

Hello Michael, I'd expect to see "hibr" here. Please check whether the file starts with the proper magic string. Or did you already decompress the file? If so, then please either decompress the original file using "hibinfo" or try "ident" on the existing one. Regarding Matthieu's post: As far as I know, X-Ways switched to a different implementation of the decompression algorithm after my blog post appeared. I *think* it works as expected, but as a customer you may want to ask them for their (internal) test results and methodology, just to be sure. I'll be back to my office on Tuesday. Feel free to give me a call if the problem persists. Viele Gruesse, Andreas _______________________________________________ Vol-users mailing list Vol-users(a)volatilityfoundation.org http://lists.volatilityfoundation.org/mailman/listinfo/vol-users