3

As curiosity, according to my knowledge, hibernation basically moves memory data from memory to hard disk. First of all, is this true? And if so, is it possible to recover the deleted hibernation data and use it to access memory data before hibernation? So if I hibernate, then wake up, then close an application, then the memory of the application might still be present on the disk?

Also, would it be possible to "boot" using this hibernation data? (So basically force windows to wake up from hibernation by using hibernation data although the system was not put into hibernation)

3
  • This does seem to be off topic for Security as I don't see a security question here. I have voted to migrate to Super User. May 20, 2013 at 16:03
  • 3
    @AJHenderson I disagree: there is a clear security implication — data of closed applications may be present on the disk. May 20, 2013 at 18:08
  • @Gilles - I didn't say there is no security implications to recovering a hibernation file, however the question did not ask about the security implications. It asked about if they CAN be recovered, not what it means to security. I agree there are security implications, but that is what the question should be then. Every question asked in the question is about what information is there and if it is possible. Not what security implications are of that info. May 20, 2013 at 18:59

1 Answer 1

1

Answering your questions:

[...] hibernation basically moves memory data from memory to hard disk. First of all, is this true? And if so, is it possible to recover the deleted hibernation data and use it to access memory data before hibernation?

In a general sense, yes, hibernation copies data from memory, stores it to a disk, turns on some flags on the OS. When you turn the computer on again, the OS sees the "flag", knows that have to read the hibernation data, and proceeds accordingly.

If you can recover the deleted hibernation data, you can know what was in the computer memory before it was hibernated.

Also, would it be possible to "boot" using this hibernation data? (So basically force windows to wake up from hibernation by using hibernation data although the system was not put into hibernation)

Yes, just depends on the OS you're using, you would just turn the "flag" on and the system would read the hibernation data again.

For further information, take a look at this wikipedia and the corresponding notes.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .