Posts Tagged ‘memory’

Mac OS X Sleep/Hibernate and Swap Image File

Posted by:  /  Tags: , , ,

Pasquale Stirparo, @pstirparo
Artifact Description
Contents of RAM are written into the sleepimage file when the computer is put to sleep.
Numerous swap files may be found in the /var/vm/ directory with the naming convention of swapfile# (swapfile0, swapfile1, swapfile2, etc.)
File Locations
Research Links
Any Other Information
These artefacts are collected under the ma4n6 project, aiming at being single point of collection for OSX artifacts from where such locations are later shared via:
– yaml library
So that the effort is made only once, and the output reused everywhere.