Aaron, You find it :) First 4096 bytes are zeroed out. Apologize I didn't check that before posting this mail. I tested your Great tool first with a Ram dump (built with mdd) and then wanted to try it on an hiberfil.sys extracted from an Encase capture. I will work a little bit more on this (to see how to access to the valuable data after this zeroed area) before joining the IRC Thanks :) Cordiales salutations - Bests regards Jean-François From: AAron Walters <awalters(a)4tphi.net> To: Jean-Francois Ragu/France/IBM@IBMFR Cc: vol-users(a)volatilityfoundation.org Date: 12/09/2008 17:34 Subject: Re: [Vol-users] hiberfil.sys Jean-Francois, Can you please clarify what you mean by a "dead system"? The real question is whether the system was hibernating when it "died". Can you do me a favor and open the file in a hex editor? Has the first page been zeroed out? In that instance, it needs a little extra processing but it can still be analyzed. As for Sandman, I don't think the public black hat released supported hiberfils that were not in use. Matthieu is a member of this list and would be able to confirm that. If you use IRC and want to discuss it more, you may also consider joining the #volatility channel where we all hang out. Thanks, AW On Fri, 12 Sep 2008, Jean-Francois Ragu wrote: to Sauf indication contraire ci-dessus:/ Unless stated otherwise above: Compagnie IBM France Siège Social : Tour Descartes, 2, avenue Gambetta, La Défense 5, 92400 Courbevoie RCS Nanterre 552 118 465 Forme Sociale : S.A.S. Capital Social : 542.737.118 euros SIREN/SIRET : 552 118 465 02430

On a 32-bits windows hibernation file, we can retrieve the page/structure (MEMORY_RANGE_ARRAY) that contains the list of all physical page mapped like this: 1) Retrieve the first compressed block, starting by XPRESS_MAGIC "\x81\x81xpress". We note X the page number of the first xpress block. 2) Now we can retrieve MEMORY_RANGE_ARRAY offset like this: (X - 1) * PAGE_SIZE Here is a sample of code aiming at retrieving MEMORY_RANGE_ARRAY after having the first page wiped: for (FirstPageTable = 0; FirstPageTable < 10; FirstPageTable++) { if (memcmp(s->Map + (FirstPageTable * PAGE_SIZE), XPRESS_MAGIC, 8) == 0) break; } // // Note: We only scan the 10 first pages. It's enough for 32bits hibernation file. // if (FirstPageTable == 10) return s; s->MemArray = (PMEMORY_RANGE_ARRAY) (s->Map + (FirstPageTable - 1) * PAGE_SIZE); Cheers, On Mon, Sep 15, 2008 at 6:37 PM, AAron Walters &lt;awalters(a)4tphi.net&gt; wrote: -- Matthieu Suiche