Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

As curiosity, according to my knowledge, hibernation basically moves memory data from memory to hard disk. First of all, is this true? And if so, is it possible to recover the deleted hibernation data and use it to access memory data before hibernation? So if I hibernate, then wake up, then close an application, then the memory of the application might still be present on the disk?

Also, would it be possible to "boot" using this hibernation data? (So basically force windows to wake up from hibernation by using hibernation data although the system was not put into hibernation)

share|improve this question
    
This does seem to be off topic for Security as I don't see a security question here. I have voted to migrate to Super User. –  AJ Henderson May 20 '13 at 16:03
3  
@AJHenderson I disagree: there is a clear security implication — data of closed applications may be present on the disk. –  Gilles May 20 '13 at 18:08
    
@Gilles - I didn't say there is no security implications to recovering a hibernation file, however the question did not ask about the security implications. It asked about if they CAN be recovered, not what it means to security. I agree there are security implications, but that is what the question should be then. Every question asked in the question is about what information is there and if it is possible. Not what security implications are of that info. –  AJ Henderson May 20 '13 at 18:59
add comment

1 Answer

Answering your questions:

[...] hibernation basically moves memory data from memory to hard disk. First of all, is this true? And if so, is it possible to recover the deleted hibernation data and use it to access memory data before hibernation?

In a general sense, yes, hibernation copies data from memory, stores it to a disk, turns on some flags on the OS. When you turn the computer on again, the OS sees the "flag", knows that have to read the hibernation data, and proceeds accordingly.

If you can recover the deleted hibernation data, you can know what was in the computer memory before it was hibernated.

Also, would it be possible to "boot" using this hibernation data? (So basically force windows to wake up from hibernation by using hibernation data although the system was not put into hibernation)

Yes, just depends on the OS you're using, you would just turn the "flag" on and the system would read the hibernation data again.

For further information, take a look at this wikipedia and the corresponding notes.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.