The exploitation of Windows hibernation files to “look back in time” and uncover compelling evidence is crucial to digital forensics practitioners. Hibernation Recon not only supports active memory reconstruction from Windows XP, Vista, 7, 8/8.1, and 10 hibernation files, but also extracts massive volumes of information from the multiple types (and levels) of slack space that often exist within them. Additional features of Hibernation Recon include the automatic recovery of valuable NTFS metadata and parallel processing of multiple hibernation files. Digital forensics practitioners cannot afford to analyze electronic evidence without extracting maximum value from Windows hibernation files.
If Hibernation Recon is run without a license, it will run in “Free Mode” and provide core functionality. If Hibernation Recon is licensed, it will run in “Professional Mode” with full functionality enabled. More information can be found in Arsenal Recon’s FAQ.
Reconstruction of active memory from Windows XP, Vista, 7, 8/8.1, and 10 hibernation files
Only tool that properly supports extraction of multiple types and levels of hibernation slack
Automatic recovery of valuable NTFS metadata