hiberfil.sys.

The compressed Windows hibernation file that stores a near-complete snapshot of physical memory at hibernation time, providing forensic access to RAM contents from a powered-off system. It belongs to the Forensics & IR category of cybersecurity.

The compressed Windows hibernation file that stores a near-complete snapshot of physical memory at hibernation time, providing forensic access to RAM contents from a powered-off system.

When Windows hibernates or performs a Fast Startup shutdown, the kernel writes a compressed image of physical memory to C:\hiberfil.sys before powering off. The file uses Xpress-Huffman compression and contains process lists, network connections, loaded modules, kernel structures, and userland data exactly as they existed at hibernation. Forensic analysts decompress hiberfil.sys with tools such as Volatility's hibinfo, hibr2bin, or Hibernation Recon, then treat the resulting raw image like a memory dump. This is especially useful when the host is encountered powered-off: it yields evidence about processes, injected code, and credentials that would otherwise be unrecoverable. Modern Windows often uses Hiberboot, so even normal shutdowns can leave a usable hiberfil.

Defences for hiberfil.sys typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Hibernation file, Windows hibernation image.