Windows Hibernation File (hiberfil.sys)
| Format | Windows Hibernation File (hiberfil.sys) |
|---|---|
| Short name | hiberfil |
| Category | memory |
| Platforms | Windows |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
The compressed copy of physical memory Windows writes on hibernation and, with Fast Startup, on every shutdown (kernel session only). Contains processes, network state and decrypted keys as they were in RAM. Windows 8 and later compress with Xpress or Xpress Huffman and, after resume, keep the header but zero everything after the first 4 KiB, so the content is only available between hibernation and the next power-on; up to Windows 7 only the first page is wiped and compressed memory pages can remain.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 68 69 62 72 | hibr | Header signature 'hibr' (Windows XP and earlier) |
| offset 0 (0x0) | 48 49 42 52 | HIBR | Header signature 'HIBR' (Windows Vista and later) |
| offset 0 (0x0) | 77 61 6B 65 | wake | Header signature 'wake' after resume (Windows XP and earlier) |
| offset 0 (0x0) | 57 41 4B 45 | WAKE | Header signature 'WAKE' after resume (Windows Vista and later) |
| offset unknown | 52 53 54 52 | RSTR | Header signature 'RSTR' at offset 0 during restore; the same bytes start an NTFS $LogFile restart page |
Known extensions
.sys
References
- Windows Hibernation File (hiberfil.sys) format, up to Windows 7 (libyal/libhibr) https://github.com/libyal/libhibr/blob/main/documentation/Windows%20Hibernation%20File%20(hiberfil.sys)%20format.asciidoc
- Modern Windows Hibernation File Analysis (Sylve, Marziale, Richard — Digital Investigation, 2016) https://cct.lsu.edu/~golden/Papers/modern-windows-hibernation-2017.pdf
- ForensicsWiki — Hiberfil.sys https://forensics.wiki/hiberfil.sys/
Cite this entry
Crush Format Reference, “Windows Hibernation File (hiberfil.sys)”. https://kalink0.github.io/crush-forensics/formats/hiberfil/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction