SUSA-HR-084 -- Hibernation Recon case worksheet
This is a blank worksheet, not evidence or a hibernation image.
Use actual values from your authorised training acquisition and processing run.

BEFORE PROCESSING
Examiner / authority / scope:
Case question:
Evidence host / image identifier (not the analyst VM):
Original hiberfil.sys path and file system metadata reference:
Acquisition method / export method / time and time zone:
Manifest location / expected SHA-256:
Protected acquired file path / size / SHA-256:
Verified input copy path / SHA-256:
Known hibernation type / evidence Windows version / architecture:
Unknown or missing source context:
Tool download source / date / retained package:
Hibernation Recon version / executable path / hash:
Mode / launch context / selected options:
Output destination / checked free space / capacity estimate source:

PROCESSING RECORD
Start time and time zone:
Finish time and time zone:
Final status / screenshot path:
HibRec.log location / reviewed source path:
Warnings / errors / missing or unrecoverable content:
Completed run folder / output-inventory.csv reference:
Retry folder / reason / retained failed run (if any):

HANDOVER CHECK
Analysis copy path / matching SHA-256 record:
Optional analysis performed (or not performed):
Analysis tool version / executable SHA-256 / command:
Search term / exit code / errors / result (if performed):
Observation / source location and context:
Interpretation / confidence / alternative explanations:
Hibernation and reconstruction limitations:
Independent corroboration available / next check:
Retained case location outside the disposable VM:
Copy verification / rollback or cleanup record: