3

The following is quoted from the "Security improvements" section of this article.

"In response to our public complaint regarding the missing API for encryption of Windows hibernation files, Microsoft began providing a public API for encryption of hibernation files on Windows Vista and later versions of Windows..."

However, googling failed to reveal more information such as the name of the API. Perhaps I am googling on the wrong terms... Does anybody has any ideas?

NotMe
  • 87,343
  • 27
  • 171
  • 245
Lopper
  • 3,499
  • 7
  • 38
  • 57

2 Answers2

0

From IRP_MN_DEVICE_USAGE_NOTIFICATION

System components send this IRP to ask the drivers for a device whether the device can support a special file. Special files include paging files, dump files, and hibernation files. If all the drivers for the device succeed the IRP, the system creates the special file. The system also sends this IRP to inform drivers that a special file has been removed from the device.

Of course, this only matters if you write a Crash Dump Filter Driver like TrueCrypt and handle file system driver operations like IRP_MJ_READ/IRP_MJ_WRITE and encrypt the file data somehow.

Sheng Jiang 蒋晟
  • 15,125
  • 2
  • 28
  • 46
0

I'm pretty sure MS uses BitLocker to encrypt the system volume including system and hibernation files.

http://technet.microsoft.com/en-us/library/cc734125%28WS.10%29.aspx

The necessary file to include is called fveapi.dll

NotMe
  • 87,343
  • 27
  • 171
  • 245