corpus.blog
41,554 blogs · 4,830,141 posts Claim your blog
Record · corpus.blog/posts/01a0c539-97e4-713b-a7a5-b673aba13fbe

Parsing the hiberfil.sys, searching for slack space

diablohorn.com · published 10 December 2014

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at diablohorn.com Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
External links
13
Words captured
2,735

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
http://digital-forensics.sans.org/blog/2014/07/01/hibernation-slack-unallocated-data-from-the-deep-past
digital-forensics.sans.org
https://github.com/DiabloHorn/find_hib_slack
github.com
http://lcamtuf.blogspot.nl/2014/10/psa-dont-run-strings-on-untrusted-files.html
lcamtuf.blogspot.nl
http://msdn.microsoft.com/en-us/library/ms912851(v=winembedded.5
msdn.microsoft.com
http://www.blackhat.com/presentations/bh-usa-08/Suiche/BH_US_08_Suiche_Windows_hibernation.pdf
blackhat.com
http://stoned-vienna.com/downloads/Hibernation%20File%20Attack/Hibernation%20File%20Format.pdf
stoned-vienna.com
http://stoned-vienna.com/html/index.php?page=hibernation-file-attack
stoned-vienna.com
http://sandman.msuiche.net/docs/SandMan_Project.pdf
sandman.msuiche.net
https://github.com/volatilityfoundation
github.com
http://download.microsoft.com/download/7/E/7/7E7662CF-CBEA-470B-A97E-CE7CE0D98DC2/HiberFootprint.docx
download.microsoft.com
http://msdn.microsoft.com/en-us/library/ms912851(v=winembedded.5).aspx
msdn.microsoft.com
http://msdn.microsoft.com/en-us/library/windows/desktop/aa373229(v=vs.85).aspx
msdn.microsoft.com
http://msdn.moonsols.com/
msdn.moonsols.com
Elsewhere on diablohorn.com (1)