# X-Ways Forensics Beta 2 and hibernation file. (coincidence?)

URL: https://www.msuiche.com/posts/x-ways-forensics-beta-2-and-hibernation-file.-coincidence/
Date: 2008-04-03
Author: Matt Suiche
Tags: dfir


---



X-Ways (WinHex editor) Forensics Beta 2 now includes hibernation file(hiberfil.sys) support for Windows XP 32-bit only. Please notice, Sandman library/framework is an open-source project under GNU General Public License v3 to read and write the hibernation file released 2 months ago...

> Posted on Friday, Mar 28, 2008 – 1:05:
> * Ability to decompress Windows XP 32-bit hiberfil.sys files, whether
> active or inactive, to get a dump of physical memory with all in-use
> pages from a previous point of time when the computer entered into
> hibernation, as well as individually carved xpress chunks from
> hiberfil.sys files, including xpress chunks located in the “slack” of
> hiberfil.sys that are even older. This feature is available in Edit |
> Convert. (forensic license only)
[Source](https://www.x-ways.net/winhex/forum/messages/1/2252.html)

(PS: I’m not beta-tester)