Volatility Notes

From Simson Garfinkel
Revision as of 15:53, 4 December 2010 by Simson (talk | contribs) (Created page with "To decompress a windows hibernation file using volatility, the syntax is: $ volatility hibinfo -f hiberfil.sys -d hiberfil.sys.decomp")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigationJump to search

To decompress a windows hibernation file using volatility, the syntax is:

 $ volatility hibinfo -f hiberfil.sys -d hiberfil.sys.decomp