Investigating hibernation files
The first alternative source we will look at is a hibernation file. There is a reason we are starting here, as a hibernation file is a compressed copy of Random Access Memory (RAM). This copy is created when the computer goes into hibernation mode when it is enabled. It is a power-saving mode of the operating system that allows the contents of the memory to be saved to nonvolatile memory in a hiberfil.sys file before powering off. This is the main difference between sleep mode and hibernation mode because the power supply is completely cut off when hibernation is used.
Because a hibernation file is a copy of RAM at the time the computer goes into power-saving mode, it can contain files that the user was working with, even if those files are no longer present on disk at the time when the hibernation file is taken for analysis. This source may therefore play an important role in forensic investigation, so how do we obtain this file?
