This is a pretty new tool and a very cool one, Hibernation is a fairly new feature for Windows so it’s good to see a new tool targeting that.
Microsoft provides a feature called Hibernation also know as suspend to disk that aims to save the system state into an undocumented file called hiberfil.sys. This file contains all the physical memory saved by the Operating System and aims to be restored by the user the next time the computer is powered on. Live forensics analysis is used to use physical memory dump to recover information on the targeted machine.
One of the main problems is to obtain a readable physical memory dump, hibernation is an efficient way to save and load physical memory. Hibernation analysis has notable advantages. System activity is totally frozen, therefore coherent data is acquired and no software tool is able to block the analysis. The system is left perfectly functional after analysis, with no side effects.
The hibernation file opens two valuable doors:
The first one is forensics analysis for defensive computing. Hibernation is an efficient and easy way to get a physical memory dump. But the main issue about it was: How to read the hiberfil.sys? This is why SandMan was born.
The second one is a new concept we will be introducing and called “offensics” which is a portmanteau from “offensive” and “forensics”. If we can read hiberfil.sys, can we rewrite it? The answer is: Yes, with SandMan you can.
Sandman is a C Library that aims to read the hibernation file, regardless of Windows version. Thus, it makes possible to do forensics live analysis on the dumped file.
For a good explanation and technical info I suggest you read the whitepaper:
You can download Sandman here:
Or read more here.
- OAT – Microsoft OCS Assessment Tool (Office Communication Server)
- SamuraiWTF 3.x And Onwards – Web Testing Framework Linux LiveCD
- Watcher – Passive Web Application Vulnerability Scanner
- PReplay – A pcap Network Traffic Replay Tool for Windows
- StreamArmor – Discover & Remove Alternate Data Streams (ADS)
- CUDA-Multiforcer – GPU Powered High Performance Multihash Brute Forcer
Most Read in Hacking Tools:
- Top 15 Security/Hacking Tools & Utilities - 1,904,535 views
- Brutus Password Cracker – Download brutus-aet2.zip AET2 - 1,136,362 views
- wwwhack 1.9 – Download wwwhack19.zip Web Hacking Tool - 640,680 views