Thank you @volatility - hibernation file converted, Password recovered - TrueCrypt volume decrypted. Good Guys 1 - Bad Guy 0. #DFIR
3
3
1
Replying to @haguec
@haguec Did you do the password recovery with @volatility, or something like Passware?

Feb 22, 2013 · 4:32 AM UTC

1
Replying to @hal_pomeranz
@hal_pomeranz @volatility converted with the imagecopy plugin then loaded into passware. The RAW hiber..sys file yielded nothing.