9:22 p.m.
The "imagecopy" plugin in Volatility 2.4 does not decompress hiberfil.sys
files from Windows 8 machines, at least in the tests that I have tried. In
most cases, I'm getting identical files out, which means that the
hiberfil.sys wasn't translated into a native physical address space, which
suggests it's not supported? I have also tried using the Moonsols Windows
Memory Toolkit which claims to support Windows 8, but that software seems
to fail as well.
Has anybody had any luck with uncompressing a Windows 8 hiberfil.sys file?
Is there any other tool I can use to accomplish this?
TIA
11:01 p.m.
We do not yet have support for windows 8/2012 hibernation files.
In my initial tests, the latest (paid) version of moonsols tools did correctly convert
hiberbation files for windows 8. What error did you encounter for that tool?
All the best,
-Jamie
-----Original Message-----
From: J U <jaredulr(a)gmail.com>
Sender: vol-users-bounces(a)volatilityfoundation.org
Date: Tue, 19 Aug 2014 21:22:42
To: <vol-users(a)volatilityfoundation.org>
Subject: [Vol-users] Decompressing Windows 8 hiberfil.sys files
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
3739
days inactive
3739
days old
vol-users@lists.volatilityfoundation.org
1 comments
2 participants
participants (2)
-
J U -
Jamie Levy