Watch Hibernation Recon Perform Parallel Processing of Three Windows Hibernation (hiberfil.sys) Files
iSpeech
Watch Hibernation Recon Perform Parallel Processing of Three Windows Hibernation (hiberfil.sys) Files - Reconstructing active memory, extracting various types (and levels) of slack, and recovering NTFS metadata! Two of the hibernation files (Windows Vista and 7) are in legacy format and one (Windows 10) is in modern format. Note that this demonstration was performed in a virtual machine with limited resources, imagine on a dedicated forensic workstation! Digital forensics experts armed with Hibernation Recon are in command of a truly unique and powerful weapon.
source
Gloss