Neither hiberfil.sys nor page file(s) are encrypted, but hiberfil.sys is compressed. Pretty much any forensic tool, including our own, can decompress the hibernation file. Or you can check out the following links:
http://forensicsfromthesausagefactory.blogspot.de/2010/09/hiberfil-xpress.html
and
http://tech.groups.yahoo.com/group/win4n6/message/3834
↧