[Vol-users] Analyzing a hiberfil.sys

Matthieu Suiche msuiche at gmail.com
Thu Jul 2 10:25:54 CDT 2009

Agreed with Andreas. The first page is propably empty.

I dont have the last version of XWays.

Anyway, Ill release in the following months a package of useful tools
for file conversion. Including a hibr2bin.exe tool with Windows 2000

Kind Regards,
Matthieu Suiche

On Thu, Jul 2, 2009 at 5:14 PM, Andreas Schuster<a.schuster at yendor.net> wrote:
> Hello Michael,
>> Signature:
> I'd expect to see "hibr" here. Please check whether the file starts with the
> proper magic string. Or did you already decompress the file? If so, then
> please either decompress the original file using "hibinfo" or try "ident" on
> the existing one.
> Regarding Matthieu's post: As far as I know, X-Ways switched to a different
> implementation of the decompression algorithm after my blog post appeared. I
> *think* it works as expected, but as a customer you may want to ask them for
> their (internal) test results and methodology, just to be sure.
> I'll be back to my office on Tuesday. Feel free to give me a call if the
> problem persists.
> Viele Gruesse,
> Andreas
> _______________________________________________
> Vol-users mailing list
> Vol-users at volatilityfoundation.org
> http://lists.volatilityfoundation.org/mailman/listinfo/vol-users

More information about the Vol-users mailing list