A forensic examiner finds a file in the root directory used to store RAM contents during hibernation. Which file is this?

A forensic examiner finds a file in the root directory used to store RAM contents during hibernation. Which file is this?

• A. Thumbs.db
• B. Hiberfil.sys
• C. Prefetch
• D. CCleaner

Answer: (B)

Storing RAM contents during hibernation is what this file is designed to do. On Windows systems, when the computer enters hibernation, the entire contents of RAM are written out to a dedicated file called hiberfil.sys located in the root of the system drive. This allows the machine to power off completely and then resume exactly where it left off by loading that memory image back into RAM. For a forensic examiner, finding hiberfil.sys is a strong indicator that a hibernation state from the system was captured, and it can contain sensitive data that was resident in memory at the time of hibernation. The other options are not related to saving RAM: thumbs.db stores image thumbnails; Prefetch is used to speed up program startup by caching execution data; CCleaner is a cleaning tool.

Storing RAM contents during hibernation is what this file is designed to do. On Windows systems, when the computer enters hibernation, the entire contents of RAM are written out to a dedicated file called hiberfil.sys located in the root of the system drive. This allows the machine to power off completely and then resume exactly where it left off by loading that memory image back into RAM. For a forensic examiner, finding hiberfil.sys is a strong indicator that a hibernation state from the system was captured, and it can contain sensitive data that was resident in memory at the time of hibernation. The other options are not related to saving RAM: thumbs.db stores image thumbnails; Prefetch is used to speed up program startup by caching execution data; CCleaner is a cleaning tool.