12:03 p.m.
I tried the hibr2dmp utility, but it fails on both my Vista possible hacking hibernation
file, as well as a Vista 32-bit test hibernation file. Both contain a block of zeros at
the beginning of the file.
Howard Patterson
Special Agent
Technical Services Unit
Tennessee Bureau of Investigation
615-744-4376
howard.patterson(a)tn.gov
12:05 p.m.
http://moonsols.com/product
There is a free Edition which should work on a 32-bits Windows Vista.
Best Regards,
--
Matthieu Suiche
On Tue, May 18, 2010 at 6:03 PM, Howard Patterson
<Howard.Patterson(a)tn.gov>wrote:
I tried the hibr2dmp utility, but it fails on both my
Vista possible
hacking hibernation file, as well as a Vista 32-bit test hibernation file.
Both contain a block of zeros at the beginning of the file.
Howard Patterson
Special Agent
Technical Services Unit
Tennessee Bureau of Investigation
615-744-4376
howard.patterson(a)tn.gov
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
1:48 p.m.
I was using the free community edition. I tried running it on both an XP and Vista
machine, with the same results. I've attached a capture of the error message. The
hiberfil.sys file from the case was copied from an Encase image; the other was extracted
with FTK Imager from a live system.
Howard Patterson
Special Agent
Technical Services Unit
Tennessee Bureau of Investigation
615-744-4376
howard.patterson(a)tn.gov
5751
days inactive
5751
days old
vol-users@lists.volatilityfoundation.org
2 comments
2 participants
participants (2)
-
Howard Patterson -
Matthieu Suiche