Posts Tagged ‘hiberfil.sys forensics’

Forensic examination in the registry has long been referred to the analysis of only readily available Registries from Microsoft Windows®, often one at a time, in vain takes a lot of time and an archaic way. Registry Recon is not just another Registry parser. Digital forensics experts armed with Hibernation Recon are now able to leverage not only the active contents of Windows hibernation files, but also massive volumes of information in the multiple types (and levels) of slack space that often exist within them.

Hibr2Bin is a tool developed by Comae Technologies (ex MoonSols), which enables a digital forensic examiner to uncompress Windows hibernation file (hiberfil.sys).