3

As I know Rekall and Volatility don't support Windows 10 hiberfil.sys analysis. Corresponding issue marked with Win 8/Win 10 is still opened.

Is there any tools (free, paid, open source, any) that able to reconstruct address space or unpack hiberfil.sys file to plain binary form?

Improve this question
2

2 Answers 2

Reset to default
2

We recently added a "Free Mode" to Hibernation Recon which will extract the active contents from your Windows hibernation files (legacy or modern formats) into physical memory dumps. You will also get statistics related to the various kinds of slack within the hiberfil.sys files and interesting NTFS metadata within both active contents and slack.

Here's a direct download link:

https://arsenalrecon.com/apps/download/HibernationRecon_1.1.0.55_Beta.zip

Some screenshots and more information here:

https://arsenalrecon.com/apps/hibernation-recon/

We'll post updates @ArsenalArmed.

Improve this answer
1

It looks like the commercial EnCase Forensics supports Windows 10 to some extent since version 7.12 (they're now at 8). You might want to check it out with them.

The Moonsols Windows Memory Toolkit has an utility called "hibr2bin.exe" that is able to convert windows8 hibernation files to raw dumps, those should be similar to windows10's, so they have a good chance of working.

Additionally, I encountered this message from more than a year ago:

We've analyzed the hiberfil.sys file format of Windows 8, and will release a Decompressor a month later. Anybody who want to joint us or want to own the Decompressor may mail to us, [email protected].

you might want to hit him up.

Improve this answer
4
  • No, EnCase doesn't support it and I didn't find any EnScript to do that. Link to Moonsols looks strange, in description information about support up to Windows 7. I've googled a bit, Moonsols is still owned by Matt Suiche.
    – Nikita
    Commented Oct 11, 2016 at 22:06
  • Mentioned Volatility issue was merged into Issue #25 and unfortunately it still opened.
    – Nikita
    Commented Oct 11, 2016 at 22:08
  • 1
    Thanks for the corrections, edited. I linked to that issue solely for the message I quoted.
    – NirIzr
    Commented Oct 11, 2016 at 22:11
  • 1
    @Nikita In the past I've reverse engineered one of VMWare's file formats for volatility, so I'm guessing it won't be too hard to do for hibernation files.
    – NirIzr
    Commented Oct 18, 2016 at 1:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.