In a recent discussion about hardware hacks, attacks surrounding Windows hibernate popped up. I am not entirely convinced that it would be viable to get stuff out of the memory saved to disk.
When Windows hibernates, it puts the contents of RAM to a file on disk (and maybe other stuff too, I don't know) and then turns off. When it turns back on, I'm assuming, it pops the saved RAM contents on to the actual RAM itself.
So a hypothetical attack would be to either steal the saved disk file, thereby stealing RAM contents, which may include sensitive data such as passwords, or do a memory corruption by changing the RAM contents, by adding/editing instructions so that arbitrary code is executed.
Now, I know that an attacker having physical access to a machine can do just about anything, but taking these specific attacks into consideration, is this at all possible? Assuming there is no disk-wide encryption, does Windows actually encrypt the saved RAM when it hibernates?
Also, does anyone know where this file will be stored? So that, I can try hands-on to view contents of the disk, maybe using a LiveCD?