Hiberfil.sys Forensics Cheat Sheet

What it is

When Windows hibernates, it compresses the contents of physical memory into C:\hiberfil.sys so the session can be restored at next power-on. Since Windows 8, Fast Startup (hybrid shutdown) also writes to it at every normal "Shut down": user sessions are logged off, and the kernel session and drivers are saved. For an investigator, the file is a memory image frozen at a past moment, available even when a live RAM capture was not possible.

Location

Windows version	Path	Notes
XP / Vista / 7	`C:\hiberfil.sys`	Written on hibernation only
8 / 8.1 / 10 / 11	`C:\hiberfil.sys`	Written on hibernation and, with Fast Startup enabled, on shutdown (kernel session only)

The file exists only when hibernation is enabled (powercfg /h on). powercfg /h off deletes it.

What it proves

A full hibernation image contains what RAM contained: running processes and command lines, loaded drivers and DLLs, network connections, injected code, registry data in memory, and fragments of user data.
A Fast Startup image contains only the kernel session, but still holds drivers, kernel structures and some system state; user processes are gone.
It proves the state at one moment: the last hibernation or hybrid shutdown, which may be days before the incident was noticed.
Data from the in-memory ShimCache and other caches not yet flushed to disk can be recovered from it.

Key fields

Element	Meaning
Header	Signature, page size, system time of hibernation and table of compressed sets
Compressed page sets	Memory pages, compressed (Xpress LZ77, and LZ77+Huffman on recent Windows 10/11 builds)
Kernel / user sections	Recent versions store the kernel section and the rest separately

Timestamps

Timestamp	Set when	Format	Pitfalls
File $SI modification time	Last hibernation or hybrid shutdown	NTFS, UTC	On resume, the header is updated, so the file no longer describes a restorable image
Timestamps inside memory structures	Process creation, connection times, etc.	Per structure (mostly FILETIME, UTC)	Reflect the moment of hibernation, not the time of analysis

Retention and clearing

The file is overwritten at each hibernation or hybrid shutdown, so it only ever holds the last one.
After a successful resume, the content is partly invalidated; older data may remain in slack pages and can be carved.
Disabling hibernation deletes the file; the deleted clusters may still be recovered from a disk image.

Collection

KAPE target: MemoryFiles (raw copy of hiberfil.sys, pagefile.sys, swapfile.sys and minidumps)
Velociraptor (Windows.Triage.Targets): MemoryFiles
Built-in: the file is locked; collect it with raw NTFS access or from a disk image. Record the configuration:

powercfg /a
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v HiberbootEnabled

HiberbootEnabled = 1 means Fast Startup is on.

Parsing tools

Volatility 3: recent releases include a hibernation layer and the windows.hibernation.Info / windows.hibernation.Dump plugins, which convert modern hibernation files into a raw memory image for the usual windows.* plugins.
Hibr2Bin (Comae, open source): converts hibernation files to raw images.
Hibernation Recon (Arsenal Recon): decompresses active and slack content.
bulk_extractor / YARA: indicator searches once the file is decompressed.

The RAM Parser runs its plugins on raw memory images: convert hiberfil.sys to a raw image first, then load the result.

Investigation tips

Always collect hiberfil.sys from laptops: it may hold the only memory image from before the incident was contained.
Check HiberbootEnabled: on Fast Startup systems every normal shutdown refreshes the file, so a "clean" shutdown by the user overwrites it.
Compare process lists from the hibernation image with disk execution artifacts (Prefetch, Amcache) to find processes that left no trace on disk.
Extract executables from the image and triage them as PE files.
For wider memory coverage add pagefile.sys and crash dumps.

hiberfil.sys (hibernation file)

Tools