International Journal of Scientific & Engineering Research, Volume 7, Issue 12, December-2016 42

ISSN 2229-5518

Role of Hibernation File in Memory Forensics of windows 10

Azad Singh
M.Tech Student, Department of Computer Science & Applications, Kuruksheta University, Kurukshetra-136119
[email protected]
Pankaj Sharma
M.Tech Student, Department of Computer Science & Applications, Kuruksheta University, Kurukshetra-136119
[email protected]
RajenderNath
Professor, Department of Computer Science & Applications, Kuruksheta University, Kurukshetra-136119
[email protected]

--------------------------------------------------------ABSTRACT-----------------------------------------------------------------

Digital media devices are regularly seized pursuant to criminal investigations and Microsoft Windows is the
most commonly encountered platform on seized computers. Memory forensics gives the volatile artifacts
from the system as they play a significant role in reconstructing the events along with static artifacts from the
system storage. Hibernation file is identified as an essential part of digital forensics, which provides analysts
with snapshots of system memory from various points in the past. Hibernation file includes web, email and
chat sessions in addition to running processes, login credentials, encryption keys, program data and much
more. The purpose of this work is to study the hibernation file and page file, there role in memory forensics
and to explore current technologies and concept for analysis. This study includes the windows hibernation

IJSER
features, file formats, potential evidence saved to the file and impacts in digital forensic investigations and
also compares page file and hibernation file in order to validate the evidences and finding additional artifacts.

Keywords:Hibernation file, Page file, Swap file,Window forensics

1. INTRODUCTION along with the static artifacts that are quite similar to
Microsoft windows dominates the world’s desktop the older versions of windows [3]. Windows systems
operating systems with 90.97% share and windows contain an energy saving feature called hibernation or
10 have market share of 14.15% till march 2016 and hybrid sleep. This feature is activated when a system
is growing at a remarkable pace, still windows 7 sits idle for a set time or if the laptop lid is closed.
holds the a total of 51.89% [1], but soon it will Upon activation, the systems memory is copied to the
change as Microsoft will terminate its main stream hibernation file, hiberfil.sys, in order to place the
support of windows 7, encouraging users to upgrade system in a lower power state. This file provides
to newer versions of windows [2]. The new features memory image to analysts, from the last time the
added to the windows 10 are notification center, new system is hibernated. Memory forensics is crucial in
startup menu, frequent folders, Cortina, synced Wi-Fi many investigations because it produces the vast
hotspots, windows 10 applications (such as amount of evidence which does not exist on the hard
Facebook, mail, photos, map and many more), one drive. Memory images are not always available for
drive data , single platform for smartphones, tablets, analysis to make the hibernation file but it is the only
and PCs, new browser named edge, multiple source to retrieve the file.
desktops. These features make Windows 10 more
intelligent in detecting and responding when users 2. RELATED WORK
switch in 2-in-1 device -- like Microsoft Surface --
Till there is no much prior research work has been
between tablet and laptop modes. The light weighted
carried out on windows 10 forensics and there is a
application programs called apps that work across
lack of tools which are capable of performing
different computing devices like windows enabled
acquisition on windows 10. Hibernation is a power
smartphones, tablet, and laptops is continue in
conservation feature built in Windows operating
windows 10 with better user interaction. These
systems beginning with Windows 2000. The
features show that there is a lot of information in the
advancement of smart battery technology led to the
volatile memory of the windows 10 operating system
implementation of the hibernation mode in Windows

IJSER © 2016
http://www.ijser.org
International Journal of Scientific & Engineering Research, Volume 7, Issue 12, December-2016 43
ISSN 2229-5518

[4]. Shaver study the forensically valuable areas of 2.1.2 SWAP FILE
the windows 10 registry to find the last date/time of Window 10 includes a new virtual memory file
insertion and removal of thumb drive however he named swapfile.sys. It is stored in your system drive,
does not consider the hibernation file [5]. Murtuza along with the pagefile.sys and hiberfil.sys. Like
Shariq et al. have investigated the static and volatile pagefile.sys and hiberfil.sys, this file is stored in the
artifacts produced by windows 8.x apps from the root of your system drive — C:\ by default. It’s also
hibernation and swap files available on storage visible only if you’ve enabled “Show hidden files and
media, their work focus on the extraction of app folders” and if you have the “Hide protected
operating system files” option disabled. The swap
specific data only [6].Olazide et al. Present the
file--swapfile.sys is currently used for swapping out
analysis of user input on volatile memory of windows Microsoft’s new style of app. Microsoft has called
applications [7]. these universal apps, Windows Store apps, Metro
apps, Modern apps and other things at various points.
2.1. BACKGROUND
This section describes the Hibernation and swap file Windows can efficiently write the whole (private)
working set of a suspended Modern app to disk in
of the windows operating system.
order to gain additional memory when the system
2.1.1 HIBERNATION FILE detects pressure. This process is analogous to
The hibernation file, named hiberfil.sys, is a binary hibernating a specific app, and then resuming it when
file located in the root directory the user switches back to the app. In this case,
Windows 8 takes advantage of the suspend/resume
(%SystemDrive%/hiberfil.sys). The file format for
mechanism of Modern apps to empty or re-populate
hiberfil.sys is a Microsoft proprietary compression
an app’s working set. User spend/resume of Metro-

IJSER
whose details have only been made available through style apps is one scenario, there could be others in the
reverse engineering [8].Memory forensics is crucial future. The swap file and the regular page file have
in many investigations because it produces vast different usage patterns and different requirements
amount of evidence which does not exist on the hard with regard to space reservation, dynamic growth,
drive. Memory images are not always available for read/write policies etc. Keeping them separate makes
analysis making the hibernation file the only source things simple [11].
of this data. The hibernation file is also useful even
when a memory image is available because it 3. STRUCTURE OF HIBERNATION FILE
provides an additional data set from a previous point
The hibernation file is referenced as a “file”.
in time. When system backups are leveraged,
However it may be better defined as a volume. “A
memory snapshots can be examined from several
volume is a collection of addressable sectors that an
points in the past. Examining these historical
operating system (OS) or application can use for
snapshots can help identify malware, encryption
datastorage[12]. The hibernation file is segmented
keys, login credentials and other valuable evidence
into 4096 byte sections or pages. Memory contents
contained in memory. The hibernation feature is
are stored in the file in blocks of data called Xpress
complex and varies between operating systems and
image blocks. The first page of hiberfil.sys contains
hardware configurations. Understanding these
the header. The second page contains the processor
variations can help to produce higher quality
state and the third page is where the reserved memory
evidence. Studies of hiberfil.sys can allow the analyst
map begins. The remaining pages of the file house
to perform deep forensics, carving evidence which
are the Xpress image blocks which are organized by
may not have been obtained from forensic tools.
memory tables. The exact organization of these
Without a memory image, investigators lose valuable
blocks differs with Windows versions[13]. The
evidence such as Internet history which was cleared
hibernation files top level outline is shown in Table
or current session usernames and passwords.
1: Hibernation File Pages. Each of these segments is
Encryption keys for full or partial disk encryption
explained in more detail later in this section.
may also be extracted from memory. [9] When a
system hibernates, the contents of memory are Page First Ending File section
written into hiberfil.sys. Hiberfil.sys is overwritten byte byte
each time the system hibernates so that just one
hibernation file will be present on the system [10]. 0 0 4095 Header

IJSER © 2016
http://www.ijser.org
International Journal of Scientific & Engineering Research, Volume 7, Issue 12, December-2016 44
ISSN 2229-5518

1 4096 8191 Processor State 4. MEMORY FORENSIC TOOLS

In this section, forensic tools which can be used to
2-n 8192 EOF Reserved Memory Map acquire, convert and analyze the hibernation file are
Memory Tables reviewed. The tools included in this section were
selected based on price, functionality, user
Xpress Image Blocks friendliness and the researchers’ familiarity with
them.
Table 1: Hibernation File pages[13] MoonSols Windows Memory Toolkit: MoonSols
Hiberfil.sys header: The first page of hiberfil.sys, Windows Memory Toolkit was designed by Suiche,
page zero, contains the file header, who was the first to publish his reverse engineering
PO_MEMORY_IMAGE. The header contains of hiberil.sys. This tool is capable of acquiring the
valuable information, however unless acquisition hibernation file from a both a live system or a disk
occurs while the system is hibernating, this data will image. MoonSols decompresses and converts the
not be available because it is zeroed out when the hibernation file into a raw memory image. The image
system resumes[14]. This provides a challenge for can then be analyzed by MoonSols or any
forensic tools because they must be able to parse the othermemory forensic tool. In addition to raw image
data in the hibernation file without the benefit of the conversion, MoonSols can also convert hiberfil.sys
header were not defined in existing publications and into a crash dump format[17]. Another feature is the
require further research. inclusion of win32dd.exe and win64dd.exe which can
convert the hibernation file into a raw memory dump
Hiberfil.sys processor state: The second page of with a single click[18].

IJSER
hiberfil.sys is the processor state. This page begins at
byte offset 4096 and continues to 8191. This structure Volatility: Volatility is a widely used memory
is platform specific. The processor state contains a set forensics tool. Like MoonSols, it provides numerous
of kernel context and state registers [15]. This functionalities required for examining the hibernation
structure is exported in Windows debugging symbols file. The Volatility plugin hibinfo is used to identify
and contains the GDT and IDT offsets along with the hibernation file format. The image copy plugin
control registers CR0 and CR3[16]. This portion of can be used to convert the hibernation file into a raw
the hibernation file could provide valuable memory dump. Once converted, volatility can
information about the registry. thoroughly examine the content of the memoryimage.
Volatility is capable of analyzing the hibernation file
How data is stored in hiberfil.sys: It is important to in its native format as well. Using brute force,
understand how data is written to the hibernation file Volatility locates the data within the hibernation file,
utilizing the reserved memory map and memory even in the absence of the header data[19]. Although
tables. Current research does 15 not detail the exact Volatility is free and very powerful, the technical
procedure for writing data to the hibernation file but barrier to entry is its biggest disadvantage. Volatility
it stresses that the data is not stored consecutively is a command line tool requiring analysts to have
within the files pages. A large segment of data (over advanced skills. Additionally, each function in
4096 bytes) would logically require more than one Volatility requires the analyst to learn different
page for storage. Likewise, several smaller blocks of plugins. Manually using each plugin to extract data
data may be stored in the same page. Pages can can take longer than an all-in-one tool which will
contain a maximum of 255 Xpress image blocks [8]. extract the evidence andpresent it to the analyst in an
In order to organize this data, the hibernation file has easy to read format. Although it takes longer, an
a reserved memory map which keeps track of the analyst who is proficient with Volatility may be able
available and reserved pages. The data is broken into to extract and understand more evidence from the
Xpress blocks and stored in pages with open space. hibernation file than someone relying on the forensic
Each page contains its own memory tables to keep software to present the evidence to them.
track of the Xpress blocks within [15]. These
segments of the hibernation file are explained in WinHex: WinHex is a hex editor which contains
more detail below. several digital forensics features including the ability
to acquire the hibernation file from a live system.
WinHex offers a licensed version ranging in price

IJSER © 2016
http://www.ijser.org
International Journal of Scientific & Engineering Research, Volume 7, Issue 12, December-2016 45
ISSN 2229-5518

from around fifty U.S. dollars for personal use to

thousands of dollars for commercial packages.
WinHex takes a snapshot of the content in a live
system. The licensed version of WinHex allows the
user to copy the hibernation file from that
snapshot.The free version will not allow the saving of
files larger than 200 KB. WinHex, being a
hexadecimal editor, enables the user to view the
contents of the hibernation file (X-ways Software
Technology, 2015). Although the documentation on
WinHex tool not explicitly says it decompresses the
hibernation file, viewing the hexadecimal data of the
file confirms plain text is seen in the contents. The
free version of WinHex can be useful in viewing the
hibernation file on a live system. However, a licensed
version is needed for acquisition. The searching
capabilities of the free version of WinHex are limited
and may be useful for locating a specific piece of
evidence but not for extracting all the evidence from
the file.

IJSER
5. PROPOSED METHODOLOGY
Static data is present on disk in the form of databases
and registry files while some artifacts are present
only in the volatile memory such as cortana,
notifications window’s app e.g. facebook’s
notifications, news feeds etc., running processes,
login credentials, encryption keys and also archival
data from the hibernation file. For these reasons, a
complete forensic picture may only be available if an
investigator consider both static and volatile artifacts.
The methodology present in paper can be converted
into a tool which incorporates a graphical user
interface front-end written in Java; its back-end
activities are implemented by a collection of shell
scripts which collect volatile artifacts andarrange
them according to their timestamp and present a Figure 1 Proposed Experimental Methodology
timeline activity in order to assist the digital
investigation. The tool extracts the hibernation file Steps of proposed methodology are as
from the hard disk/dd image /user provided image follows:-
and convert it into the corresponding ram dump using i. An investigator may encounter a live
MoonSols memory tool kit. RAM dump also taken if system or have a hard drive/dd
an investigator encountera running system, using image/ewf.
MoonSols memory toolkit. Then volatility can be ii. Check whether there is live system or
used to extract the volatile data from that RAM any type of image.
dumps along with their specific timestamps. iii. In case of live system take the RAM
dump first and then boot it with Linux
Figure 1 presents the proposed methodology. In case Live CD to get the hibernation file and
of live system a RAM dump should obtain just before page file.
the system was made to hibernate. iv. Otherwise extracts the hibernation file
and page file from the hard

IJSER © 2016
http://www.ijser.org
International Journal of Scientific & Engineering Research, Volume 7, Issue 12, December-2016 46
ISSN 2229-5518

disk/ddimage/user-provided image or these issues can alter how acquired evidence is

E01 file using Linux Live CD perceived. Chief among these problems is defining
v. Converts it to the corresponding RAM what data specifically is written to hiberfil.sys.
dump using the MoonSols memory Further research could contain the particular
toolkit. methodology that includes the acquisition of a
vi. Take the RAM dump if there is live memory image followed by an immediate hibernation
system and then system made to and the comparison of the two. This methodology
hibernate and extract that hibernation would need to be repeated in different Windows
file and page file, just like in step I. versions and in different situations as it depends upon
vii. Volatility is then used to extract the the operating system and hardware. Further research
specific forensic artifacts from the can also be made by defining what happens when the
RAM dump and the data is presented in hibernation file is created, deleted or overwritten and
the JSON file format which is then how slack space is handled. This paper has a scope
parsed and classified according to which does not include an experimental analysis of
different process and specific apps. the hibernation file format or current forensic tools.
viii. Compare the data from hibernation file The topic of hibernation forensics is still in itsinfancy
and page file in order to validate the resulting in limited scholarly resources. This study
evidences and extraction of hidden could have been improved with an experimental
processes. section and the ability to acquire commercial forensic
tools.
Memory forensics is a dynamic and significant part

IJSER
of digital forensics. Due to memories volatile nature REFERENCE
and the vast wealth of evidence it can provide,
forensic professionals study memory forensics as an
autonomous piece of their education. [1] "Dekstop Operating System Market Share," april 2016.
[Online]. Available: https://www.netmarketshare.com/.
6. CONCLUSION AND FUTURE WORK
[2] "windows/lifecycle," Microsoft, [Online]. Available:
Windows Systems copy the contents of memory to http://windows.microsoft.com/en-us/windows/lifecycle.
the hibernation file when the computer enters
hibernation mode. Forensic tools are available which [3] "windows 10 forensics," Leahy Center for Digital
convert the proprietary hibernation file into a raw Investigation, 2015.
memory image so it can be examined with traditional
[4] E. Schwartz, "One-Chip Solution Powers Up Battery Life,"
memory forensic methods. This file is a valuable
Infoworld, Twentieth Anniversary 1978-1998, 20(30),
source of evidence both in the absence of and in 1998.
addition to a current memory capture. The
hibernation file format is proprietary and not wholly [5] J. S. Shaver, "Exposing vital forensic artifacts of USB
documented. Current studies rely on the publications devices in the Windows 10 registry," California: Naval
from the reverse engineering of hiberfil.sys. These Postgraduate School, 2015.
documents do not define every variable within the
structure. Additionally, the structure varies between [6] S. Murtuza, R. Verma, J. Govindara and G. Gupta, "A
Windows versions and hardware configurations. TOOL FOR EXTRACTING STATIC AND VOLATILE
FORENSIC ARTIFACTS OF WINDOWS 8. x APPS," in
Currentstudies contain conflicting reports of
Advances in Digital Forensics XI, Springer, 2015, pp. 305-
hibernation mode behavior and the resultant 320.
hiberfil.sys file. These factors demonstrate that
current research is inadequate to allow forensic [7] F. Olajide, N. Savage, G. Akmayeva and C. Shonireg,
professionals to understand the hibernation file ""Digital forensic research — The analysis of user input on
entirely. Further study is needed to accurately define volatile memory of Windows application," in Internet
the contents of the hibernation file and to identify Security (WorldCIS), 2012 World Congress on, Guelph,
variations in its format. ON, 2012.

There are many unanswered questions about the [8] M. Suiche, "SANDMAN PROJEC T,"
hibernation file requiring further study. Many of

IJSER © 2016
http://www.ijser.org
 International Journal of Scientific & Engineering Research, Volume 7, Issue 12, December-2016 47
ISSN 2229-5518

http://sandman.msuiche.net/docs/SandMan_Project.pdf. http://stonedvienna.com/downloads/Hibernation%20File%20
Attack/Hibernation%20File%20Format..
[9] E. Casey, Handbook of digital forensics and investigation,
Academic Press, 2010. [16] "Windows hibernation file for fun 'n' profit Retrieved from,"
[Online]. Available:
[10] H. Carvey, Windows forensic analysis DVD toolkit, http://www.blackhat.com/presentations/bh-usa-
Syngress, 2007. 08/Suiche/BH_US_08_Suiche_Windows_hibernation.pdf.

[11] B. Morrison, Windows 8/Windows Server 2012: The [17] "windows-memory-toolkit," moonsols, [Online]. Available:
New Swap(blogs.technet http://www.moonsols.com/windows-memory-toolkit/.
.com/b/askperf/archive/2012/10/28/windows-8-
windows-ser), Washington. [18] Ligh, H. Michael , Case, Andrew , J. Levy and W. Aaron,
The art of memory forensics: detecting malware and threats
[12] B. Carrier, in File system forensic analysis, Boston ,MA, in windows, linux, and Mac memory, John Wiley \& Sons,
Pearson Education, Inc, p. 70. 2014.

[13] P. Kleissner, "Hibernation file attack,," Retrieved from[19] "memory-forensics-and-analysis-using-volatility,"

http://stonedvienna.com/downloads/Hibernation%20File%2 infosecinstitute, [Online]. Available:
0Attack/Presentation.pdf, 2009. http://resources.infosecinstitute.com/memory-forensics-and-
analysis-using-volatility/.
[14] Diablohorn, "Parsing the hiberfil.sys, searching for slack
space," Retrieved from
https://diablohorn.wordpress.com/2014/12/10/parsing-the-

IJSER
hiberfil-sys-searchingfor-slack-space/, 2014.

[15] P. Kleissner, "Hibernation file format," Retrieved from

IJSER © 2016
http://www.ijser.org