Hibernation Recon Hands on Labs

Start in the browser: open a hibernation file, recover its saved memory and investigate a PowerShell alert. Try the Full Lab with an acquired training file in a Windows analyst VM when you are ready.

Interactive Lab

Beginner / about 10 minutes / no installation. Start in the tool window. Recover the memory, check a copy and find out what PowerShell was doing. Each step gives you a short task. Open a hint if you get stuck. Results stay on screen until you continue.

The main window follows the Hibernation Recon screenshot from version 1.2.3.96. File and folder dialogs are simplified for this browser exercise. The files and results are fictional; no real memory is processed. After recovery, you leave the tool window to check the output and review example results from a separate memory analysis tool and the Windows log.

Full Lab

Windows analyst VM / real reconstruction

Hibernation Recon Full Lab

One acquired training file

Case SUSA-HR-084 / recover a second chance

The workstation is off. Its memory may still tell a story.

A workstation raised a PowerShell alert and was found powered down. A disk acquisition contains hiberfil.sys. Your job: reconstruct its saved memory, check the result and hand it to the next analyst with an honest account of its limits.

Tick a checkpoint after saving its evidence. Progress is self reported; this page cannot check your VM.

Investigation brief

Case questionWhat can we hand over for memory analysis, and what remains unproven?

Your deliverable

A recorded reconstruction, SHA-256 inventory, matching analysis copy and short handover.

Real case link: You are processing a file exported from a disk acquisition. Hibernation Recon reconstructs memory; a separate analysis tool investigates processes and commands. The PowerShell alert is a training brief, not a promised finding in your file.

Before you start

Need: a disposable Windows analyst VM, Hibernation Recon installed using Install and open, Windows PowerShell, and a complete, acquired training hiberfil.sys with its expected SHA-256 and acquisition notes. Free Mode is sufficient for this core.

Time: allow about 30 to 45 minutes of hands on work after setup, plus processing, copying and hashing time. Large files may take much longer. Keep space for the source copy, reconstructed output and analysis copy; use the training provider's tested capacity estimate.

Run: open PowerShell in the analyst VM. Copy blocks in order in the same window. Expand one step at a time and check its Look for result. The three activities complete the core; the memory search is optional.

Where do I get the evidence file?

This page includes a case worksheet, not a hibernation image. Ask your lab provider for a complete exported file from a known good training acquisition, its manifest hash, source host/image identity, original path, acquisition method and times, and any known hibernation type. The provider should test reconstruction with the supplied tool version and note expected outputs and space needs.

Arsenal's Hibernation Recon page also demonstrates the public TechHive disk scenario; exporting evidence from a disk image is a separate preparation exercise. If you do not have an acquired file yet, complete the Interactive Lab first. Its fictional files and process results cannot be used in this Full Lab.

Use a protected acquisition copy, never your analyst VM's live C:\hiberfil.sys. Booting the evidence system can change the file. Follow the provider's acquisition procedure rather than waking a machine to collect it.

Activity 1: Establish the boundary

Your first winCreate a case you can trust: identify the input and verify a working copy.

1. Make a fresh case folder and verify the input

Edit the first two paths for your VM. D:\Training\SUSA-HR-084\hiberfil.sys is an example location for the protected acquired file, not a download supplied by this page. Enter the expected hash from its manifest when prompted. SHA-256 is a file fingerprint; a matching value checks the bytes against that reference.

$hrCase = 'C:\Cases\SUSA-HR-084'
$hrOriginal = 'D:\Training\SUSA-HR-084\hiberfil.sys'
$hrExpected = (Read-Host 'Paste the manifest SHA-256 for hiberfil.sys').Trim()
if ($hrExpected -notmatch '^[0-9a-fA-F]{64}$') { throw 'Use the 64-character manifest hash.' }
$hrSource = Get-Item -LiteralPath $hrOriginal -ErrorAction Stop
if ($hrSource.PSIsContainer -or $hrSource.Length -eq 0) { throw 'Expected a nonempty acquired file.' }
$hrOriginalHash = Get-FileHash -LiteralPath $hrOriginal -Algorithm SHA256 -ErrorAction Stop
if ($hrOriginalHash.Hash -ne $hrExpected) { throw 'Source hash mismatch. Stop and check the acquisition.' }
if (Test-Path -LiteralPath $hrCase) { throw 'Case folder exists. Use a new case path.' }
'source', 'output', 'working', 'notes' | ForEach-Object {
    New-Item -ItemType Directory -Path "$hrCase\$_" -ErrorAction Stop | Out-Null
}
Copy-Item -LiteralPath $hrOriginal -Destination "$hrCase\source\hiberfil.sys" -ErrorAction Stop
$hrCopyHash = Get-FileHash -LiteralPath "$hrCase\source\hiberfil.sys" -Algorithm SHA256 -ErrorAction Stop
if ($hrCopyHash.Hash -ne $hrOriginalHash.Hash) { throw 'Working input mismatch. Do not process it.' }
$hrOriginalHash, $hrCopyHash |
    Export-Csv -LiteralPath "$hrCase\notes\input-sha256.csv" -NoTypeInformation -ErrorAction Stop
$hrSource | Select-Object FullName, Length, CreationTimeUtc, LastWriteTimeUtc, LastAccessTimeUtc |
    Export-Csv -LiteralPath "$hrCase\notes\input-metadata.csv" -NoTypeInformation -ErrorAction Stop
"Input verified: $($hrCopyHash.Hash)"

Look for: Input verified, two matching rows in notes\input-sha256.csv, and separate source, output, working and notes folders. The metadata CSV describes the exported file; use the acquisition notes for its original file system metadata. Hashing large files can take time.

2. Save the case and tool context

Download the case worksheet, save it as notes\case-notes.txt, and fill the Before processing fields: authority, examiner, source host/image, original path, acquisition method and time zone. Use unknown for unavailable details, and explain the gap. Retain the manifest and acquisition notes with it.

Open Hibernation Recon, record its displayed version and mode in the worksheet, then use its actual executable path below. A tool hash identifies the executable you used; it does not independently establish that a download is trustworthy.

$hrTool = Read-Host 'Full path to the Hibernation Recon executable'
Get-FileHash -LiteralPath $hrTool -Algorithm SHA256 -ErrorAction Stop |
    Export-Csv -LiteralPath "$hrCase\notes\tool-sha256.csv" -NoTypeInformation -ErrorAction Stop
@(
    "Analyst VM: $env:COMPUTERNAME"
    "Recorded: $(Get-Date -Format o)"
    "Time zone: $((Get-TimeZone).Id)"
    "PowerShell: $($PSVersionTable.PSVersion)"
    "Case: $hrCase"
) | Set-Content -LiteralPath "$hrCase\notes\analyst-context.txt"
Get-Content -LiteralPath "$hrCase\notes\analyst-context.txt"

Look for: your analyst VM identity and time context, the tool hash CSV and completed source notes. The analyst VM is different from the evidence host; keep those identities separate.

Ready to recover I saved the manifest and matching protected/input-copy hashes. I saved source provenance, case notes, tool version, mode and executable hash.Pause point: keep the case folder. To resume in a new PowerShell window, set $hrCase = 'C:\Cases\SUSA-HR-084' again using your actual path.

Next: turn the acquired file into reconstructed memory.

Continue to recovery ›

Activity 2: Reconstruct and verify

Your next winProduce a recorded reconstruction and preserve every returned file.

Make your call

If recovery finishes successfully, does that mean every process from the alert is present? Write a one sentence prediction before you press Process.

1. Process the verified file in Hibernation Recon

1. Confirm output is empty. Record the start time with time zone in case-notes.txt.
2. Select Process hiberfil.sys and choose C:\Cases\SUSA-HR-084\source\hiberfil.sys (or your case path).
3. Choose the case's output folder, keeping it separate from source.
4. Use Free Mode for active memory reconstruction and record any displayed options. The install screenshots show an older interface; follow the labels in your installed version.
5. Let processing finish. Save a screenshot of its final status and record the finish time, warnings and errors. Do not close the tool while it is still writing output.

Look for: ActiveMemory.bin and HibRec.log. Open the log in Notepad and compare its input path and processing status with your notes. Retain all returned files. If active memory is absent or the run failed, use the troubleshooting table below before marking this checkpoint.

Check your prediction: successful reconstruction gives you material to investigate. It does not guarantee recovery of a specific user process. Your source may contain a full hibernation or a narrower Fast Startup state.

My output has extra files, or the run needs a retry

Professional Mode can produce additional slack and NTFS outputs. They are outside this core; inventory them without treating their absence in Free Mode as an error. Keep failed output and its log. For a retry, create an empty folder such as output-retry-01, record why, and use that folder in the inventory and copy commands below. Never merge two runs.

2. Inventory and hash the completed output

Run this only after processing has finished. Update $hrOutput if you used a retry folder. The inventory is saved in notes, outside the files it describes. It may take several minutes to hash large outputs.

$hrOutput = "$hrCase\output"
$hrMemory = Get-Item -LiteralPath "$hrOutput\ActiveMemory.bin" -ErrorAction Stop
if ($hrMemory.Length -eq 0) { throw 'Active memory is empty. Review the log.' }
if (-not (Test-Path -LiteralPath "$hrOutput\HibRec.log" -PathType Leaf)) {
    throw 'Locate and retain the processing log before continuing.'
}
Get-ChildItem -LiteralPath $hrOutput -Recurse -File -ErrorAction Stop | ForEach-Object {
    [pscustomobject]@{
        Path = $_.FullName
        Bytes = $_.Length
        SHA256 = (Get-FileHash -LiteralPath $_.FullName -Algorithm SHA256 -ErrorAction Stop).Hash
    }
} | Export-Csv -LiteralPath "$hrCase\notes\output-inventory.csv" -NoTypeInformation -ErrorAction Stop
Import-Csv -LiteralPath "$hrCase\notes\output-inventory.csv" | Format-Table Path, Bytes

Look for: a nonzero byte size for ActiveMemory.bin and an inventory row for HibRec.log. Note any warnings even if the tool reports completion. An output file's modified time is a processing time, not the time of the activity captured inside it.

Reconstruction preserved I saved the final status, processing times, selected mode/options and reviewed HibRec.log. I retained the complete run folder and its file sizes and SHA-256 inventory.Pause point: protect the output folder from editing. Keep notes beside it; analyse a separate copy in Activity 3.

Next: verify an analysis copy and explain the result.

Continue to the handover ›

Activity 3: Analyse and report

Your final winHand another analyst a matching copy, a clear result and a useful next check.

1. Create and verify the analysis copy

In the same PowerShell window, run the following. If you resumed, set $hrCase and $hrOutput to your actual case and completed run paths first. The saved inventory provides the reference hash.

$hrSaved = @(Import-Csv -LiteralPath "$hrCase\notes\output-inventory.csv" |
    Where-Object Path -EQ "$hrOutput\ActiveMemory.bin")
if ($hrSaved.Count -ne 1) { throw 'Check the selected run and inventory.' }
$hrCurrent = Get-FileHash -LiteralPath "$hrOutput\ActiveMemory.bin" -Algorithm SHA256 -ErrorAction Stop
if ($hrCurrent.Hash -ne $hrSaved[0].SHA256) { throw 'Saved output has changed. Stop and investigate.' }
$hrWorking = "$hrCase\working\ActiveMemory-working.bin"
if (Test-Path -LiteralPath $hrWorking) { throw 'Analysis copy exists. Verify it or use a new name.' }
Copy-Item -LiteralPath "$hrOutput\ActiveMemory.bin" -Destination $hrWorking -ErrorAction Stop
$hrWorkingHash = Get-FileHash -LiteralPath $hrWorking -Algorithm SHA256 -ErrorAction Stop
if ($hrWorkingHash.Hash -ne $hrCurrent.Hash) { throw 'Analysis copy mismatch. Do not analyse it.' }
$hrCurrent, $hrWorkingHash |
    Export-Csv -LiteralPath "$hrCase\notes\analysis-copy-sha256.csv" -NoTypeInformation -ErrorAction Stop
'Analysis copy verified'

Look for: Analysis copy verified and two matching hashes in analysis-copy-sha256.csv. This establishes a byte for byte copy. It does not establish that a memory parser supports the evidence platform or that every page was recovered.

Optional investigation: follow one PowerShell lead

Want a small investigation before the handover? Download Microsoft Sysinternals Strings, extract it to C:\Tools\Strings, and review its licence when first launched. Use the executable that runs on your analyst VM; the example below uses strings64.exe. Record its version and executable SHA-256 in your notes.

This scans ASCII and Unicode text in the verified analysis copy. -n 6 keeps strings of at least six characters; -o prints the location in the reconstructed file. Filter for the literal text powershell, saving matching lines rather than a huge complete strings report.

$hrStrings = 'C:\Tools\Strings\strings64.exe'
Get-FileHash -LiteralPath $hrStrings -Algorithm SHA256 -ErrorAction Stop |
    Export-Csv -LiteralPath "$hrCase\notes\strings-tool-sha256.csv" -NoTypeInformation -ErrorAction Stop
New-Item -ItemType File -Path "$hrCase\notes\powershell-leads.txt" -Force -ErrorAction Stop | Out-Null
& $hrStrings -nobanner -n 6 -o $hrWorking 2> "$hrCase\notes\strings-errors.txt" |
    Select-String -SimpleMatch 'powershell' |
    ForEach-Object { $_.Line } |
    Set-Content -LiteralPath "$hrCase\notes\powershell-leads.txt"
$hrStringsExit = $LASTEXITCODE
"Strings exit code: $hrStringsExit" | Set-Content -LiteralPath "$hrCase\notes\strings-status.txt"
if ($hrStringsExit -ne 0) { throw 'Search failed. Review strings-errors.txt; do not claim no matches.' }
Get-Content -LiteralPath "$hrCase\notes\powershell-leads.txt" -TotalCount 10

If you find matches: preserve one complete line and its printed offset in your handover. That offset refers to ActiveMemory-working.bin, not the compressed hiberfil.sys or a process virtual address. A string can come from a path, documentation or unused content; it is a lead, not proof of execution. Never run recovered commands.

If you find none: record the search term, command, exit code and errors. A successful search without matches means this text search found none; it cannot exclude PowerShell activity. A tool error is an unsuccessful search, not a negative finding.

Next real case check: use a compatible memory parser to investigate process and command line context. If a PowerShell event log is available, compare host identity, event time and script content with the lead. Record disagreements and missing data; do not force the fictional browser result onto your evidence.

2. Make the evidence call and write the handover

Make your callThe run completed, its log is retained and the analysis copy matches. What can you say now?

Every process from the alert is present.A verified reconstructed copy is ready for a compatible analysis tool, with recorded limitations.A PowerShell string would confirm a malicious command ran.

Choose the statement supported by your reconstruction and integrity checks.

Copy the template into notes\handover.txt. Replace the bracketed fields with your actual result. If you skipped the optional search, say not performed; core completion does not require finding PowerShell.

Case: SUSA-HR-084 | Examiner: [name] | Time zone: [zone]
Question: What reconstructed memory can we hand over, and what remains unproven?
Source: [host/image ID, original path, acquisition method and time, manifest reference]
Input: [working input path and verified SHA-256; see input-sha256.csv]
Tool: [Hibernation Recon version, mode, executable hash and options]
Run: [start/finish with zone, final status, HibRec.log path and warnings]
Output: [run path, ActiveMemory.bin size and SHA-256; see output-inventory.csv]
Analysis copy: [path and matching SHA-256; see analysis-copy-sha256.csv]
Observation: [what the log and verification establish; optional lead and source offset]
Interpretation: [why this is suitable for further analysis, or needs another attempt]
Optional search: [not performed, or command/tool version/exit code/result and errors]
Confidence: [what is well supported, what remains uncertain and why]
Limitations: [hibernation type if known, recovery warnings, untested parser compatibility]
Unproven: complete activity history, PowerShell execution, identity and malicious intent.
Next check: [compatible memory parsing and independent host/time/content corroboration]

Look for: a colleague can identify the source, verify the output and understand what to check next from your handover. Distinguish an observed result from its interpretation. If processing failed, retain a useful failure report and arrange a corrected input/run; do not mark successful reconstruction complete.

3. Keep the case before restoring the VM

Close Hibernation Recon and analysis tools. Copy the complete case folder, manifest and acquisition notes to controlled storage outside the disposable VM. Open the copied handover and compare retained output hashes with output-inventory.csv. Preserve failed/retried runs and their explanations too. Restore the VM snapshot only after confirming that the case is retained; remove disposable material according to the lab provider's procedure.

Look for: a retained case that another analyst can open after the VM is rolled back.

Ready for the next analyst I saved matching output/analysis-copy hashes and kept the reconstruction unchanged. I saved an evidence based handover with limitations and a next check, and retained the case outside the VM.You have completed the recovery and handover workflow. An optional search adds a lead; it never changes what reconstruction alone can prove.

Review the case closeout before restoring your VM.

Review your saved case ›

Case closeout0 of 6 evidence checkpoints marked.

• 1Identified inputManifest, acquisition notes, case worksheet, input hashes/metadata, analyst context and tool identity.
• 2Recorded recoveryComplete output folder with HibRec.log, final status screenshot, processing notes and output inventory.
• 3Verified handoverAnalysis copy, matching hashes and handover.txt. Include any optional search results, status and errors.

Your success: another analyst can reproduce your checks and see where the evidence stops. A malware verdict is not required.

Troubleshooting: get back to the next checkpoint

What you see	First check and next action
Input hash mismatch	Compare the path and manifest entry. Reexport or obtain a verified file; stop before processing.
File rejected or no active memory	Read HibRec.log. Confirm a complete acquired file, supported format/version and a previously used hibernation file; a zeroed or unused file may be unusable. Retain the failed run.
Processing stops or disk fills	Check free space, permissions and the log. Keep that run, increase capacity, and retry into a new empty output folder.
No slack or NTFS CSVs	Check the recorded mode. Those Professional features are not required for the Free Mode core.
User processes or hives seem absent	Check acquisition notes for Fast Startup or incomplete recovery. Missing content cannot establish that an activity never occurred.
Analysis copy hash differs	Stop analysis. Check the source against its saved inventory, then create a new copy without overwriting the failed one.
Optional parser cannot open memory	Record parser/version, evidence platform and errors. Verify the hash and compatibility; file creation alone does not validate parsing.

Why this workflow reflects DFIR practice

The core follows an offline evidence path: acquired input, reproducible reconstruction, protected output, verified analysis copy and a bounded handover. Arsenal's FAQ documents the output types, downstream analysis and recovery limits; its feature list distinguishes Free and Professional modes. Reconstruction is one stage of an investigation. The optional Strings task demonstrates how to preserve a lead without treating text as proof of a running process.