https://orcid.org/0000-0002-9097-2246
1. How often while using your PC u use the hibernation mode?I am sure that after reading the text below u r hardly going to use it owing to the serious compromise of your info of what you do and when you do ?
2. Ok…what do we mean by hibernation mode?......it simply means that via using this mode we are basically creating a snapshot of the contents of the computers RAM which is then saved to the root of the hard drive as “hiberfil.sys”!!!!This would now mean that the then current running applications and other data in RAM will be written to the hard disk.
3. For example, if we went into the hibernation mode with our browser still open…..then textual strings such as the last Google search performed or text from an open web page will be written to hard drive as the computer “hibernates”.
4. The Windows hiberfil.sys also become an issue while using encryption software such as TrueCrypt. If a Windows system is placed into hibernation mode without unmounting encrypted containers or volumes then the encryption keys used to access these containers will likely be left in RAM in plain-text. RAM will then be saved to the hard drive in the hiberfil.sys. This means that we will be leaving the keys (passwords) to all of your private containers and volumes free for the finding.
5. Ok…..if at all we get hold of the hiberfil.sys…is it going to be that easy to read all that hex dec info?...no certainly not…here come sandmen project for assistance….now whats SANDMEN PROJECT….pls google….in short it is a library which assists in parsing data from the hiberfil.sys.
Disable Hibernation mode on Windows XP:
• Right-click empty area on desktop
• Choose “Properties”
• Select the “Screen Saver” tab
• Click “Power…”
• Select the “Hibernate” tab
• Uncheck “Enable hibernation”
Disable Hibernation mode on Windows 7:
• Open “Control Panel”
• Click “Power Options”
• Click “Change plan settings” for you current power plan
• Click “Change advanced power settings”
• Expand “Sleep”
• Expand “Hibernate after”
• Enter “0″ for “Setting:” to set hibernate to “Never”
6. Thanks http://www.anti-forensics.com
