Hibernation File and Pagefile
Also called hiberfil.sys, pagefile.sys, swapfile.sys, memory artifacts on disk.
- PLATFORM
- Windows
- CATEGORY
- Deletion and Recovery
- INDEX
- 24 of 36
- PROVES
- 3 findings
- CANNOT PROVE
- 5 limits
- QUESTIONS
- 3 answered
Disk files holding memory content: a compressed system state written at hibernation, and pages evicted from RAM, which can hold document fragments found nowhere else.
Where it lives
C:\hiberfil.sys, C:\pagefile.sys and C:\swapfile.sys
Name the location in the preservation request rather than describing the artifact in general terms. A request that asks for the record by its path is one the responding party can act on and one a court can enforce; a request for “all forensic evidence of hibernation file and pagefile” is neither.
What it records
The hibernation file holds a compressed image of system memory written when the machine hibernates. The pagefile holds pages the memory manager evicted from RAM, written and reused with no index and no structure that maps content back to a source. Fast Startup writes a hibernation file containing kernel state rather than a full user-space capture, so the presence of a hibernation file does not mean a full memory image is available — the two cases have to be distinguished before anything is claimed about what it should contain.
What it proves — and what it cannot
These two panels carry equal weight, deliberately. The right-hand column is not a disclaimer: it is the specific, mechanical reason an inference fails, and it is the column opposing counsel will read back to a witness on cross-examination.
What it proves
FINDINGS THIS ARTIFACT WILL SUPPORT ON ITS OWN TERMS.
- That specific content existed in memory on the machine — document text, chat fragments, decrypted material, search terms and URLs that never reached disk in that form
- That a program was resident in memory at the moment of hibernation, from a full hibernation image
- The existence of strings from files that have since been deleted and overwritten in allocated space
What it cannot prove
INFERENCES IT WILL NOT CARRY, HOWEVER STRONGLY IT POINTS.
- When a fragment in the pagefile got there, or which process wrote it. The pagefile has no metadata whatsoever — no timestamps, no ownership, no file association — so a string found in it is undated and unattributed
- That a fragment came from a file rather than from a network stream, a preview pane, an email, or a clipboard buffer
- That the hibernation file holds user-space memory. A file produced by Fast Startup may contain kernel state only, and treating it as a full memory image overstates what is there
- That the absence of content proves anything. Pages are reused continuously and the pagefile can be configured to be cleared at shutdown
- Continuity of any kind. Both files are collections of fragments, not a sequence
How the finding is attacked
An opinion built on this artifact meets these arguments. Each of them is answerable, and each of them is answered before the report is served rather than at a deposition.
- Demanding the basis for attributing an undated string in the pagefile to a particular document, time or user — an attribution the structure does not support
- Distinguishing a Fast Startup hibernation file from a true hibernation image where the examiner has treated them alike
- Arguing the fragment could have arrived from any of several channels that render the same text
- Pointing to policy that clears the pagefile at shutdown, or to a disabled hibernation feature, to explain an absence
What survives, and for how long
The hibernation file persists on disk until it is overwritten by a later hibernation or removed when the feature is disabled. Pagefile content is overwritten continuously in ordinary use, so what survives is arbitrary — its value is opportunistic rather than something a preservation plan can count on.
More matters are decided by what an artifact never kept than by what it says, which makes preservation timing the most consequential decision in the matter — and it is usually made months before anyone examines anything. The evidence preservation deadline calculator works from the date you first anticipated litigation.
Questions counsel ask
What can be recovered from pagefile.sys?
Fragments of whatever was in memory and evicted: document text, message content, URLs, search terms and decrypted material that may exist nowhere else on disk. The limitation is severe and structural — the pagefile carries no metadata at all, so a recovered string has no timestamp, no owning process and no file association. It shows that content was in memory, not when or from where.
Does hiberfil.sys contain a full memory image?
Not always, and the distinction is important. A true hibernation writes a compressed image of system memory. Fast Startup, which is enabled by default on many systems, writes a hibernation file containing kernel state rather than a full user-space capture. The presence of the file does not establish that user process memory is available, and the two cases must be distinguished before the file is characterised.
Can a string found in the pagefile be tied to a document?
Not by the pagefile itself. There is no index, no timestamp and no ownership in the structure, so the same text could have arrived from a file, an email preview, a chat window, a web page or a clipboard buffer. Tying a fragment to a document requires corroboration from an artifact that does carry attribution, and stating the link without it is not supportable.
Terms used on this page
Every term below is defined in the forensic glossary — what it is, why a case turns on it, and what happens when it is mishandled.
Related artifacts
No artifact carries a matter on its own. These are the records that corroborate, contradict, or supply the timeline this one cannot.
$MFT (Master File Table)
The NTFS index of every file and directory on a volume, holding two independent sets of four timestamps per file plus, for small files, the file's entire content.
Volume Shadow Copies
Point-in-time block-level snapshots of a volume, often holding an earlier version of a file that has since been altered or deleted — sometimes the only copy of a document as it originally stood.
Windows Search Index and WordWheelQuery
The desktop search database indexes file properties and, for many file types, full text — so it can retain the content of documents that were deleted before the index was rebuilt.
Recycle Bin ($I and $R Files)
Deleted files moved to the Recycle Bin are stored as a renamed copy of the content plus a metadata file recording the original path, original size and the deletion time.
Whether the hibernation file and pagefileevidence in your matter supports the opinion built on it is a question with a testable answer. Law & Forensics retains court-tested digital forensic expert witnesses and forensic neutrals.
A conflicts check and scoping call follow, normally within one business day. Please do not send privileged or case-sensitive material until conflicts have cleared.
- Can This Artifact Prove That?
Start from the claim rather than the artifact: which records bear on it, and what no combination of them establishes.
- Computer forensics
The examination this artifact is collected and analysed in, scoped to a matter and reported so it can be tested.
- The artifact index
All 36 entries, grouped by what they bear on and filterable by platform.
- Daubert and digital evidence
Why an opinion stated one level too strongly is an admissibility problem rather than a point for cross-examination.
Attorney advertising / expert services. This page describes forensic artifacts and the procedural rules that govern expert evidence in general terms. Artifact behaviour varies by operating-system version, build, and configuration, and every observation has to be verified against the system actually in front of you. Nothing here is legal advice, and it is not a substitute for checking the rules, standing orders, and case law of your own forum.