In what file Systemd-hibernate service dumps the RAM content?

Question

I'd wanted to get it from a disk image to analyze with Volatility but I've not been able to find it (I've searched in systemd-sleep.conf file but there's no related directive) Thanks!

Answer 1

Here (https://www.linuxuprising.com/2021/08/how-to-enable-hibernation-on-ubuntu.html) or here (https://confluence.jaytaala.com/display/TKB/Use+a+swap+file+and+enable+hibernation+on+Arch+Linux+-+including+on+a+LUKS+root+partition ...it doesn't uses Systemd-hibernate but it's interesting though) are available some rellevant responses to this question

Reference doc is here (https://www.kernel.org/doc/Documentation/power/swsusp-and-swap-files.txt)

Thanks

Answer 2

Here it is:

1.- Create swap file on root partition (it's worth noting that you'll want to have a swap file at least as large as the computer's RAM)

sudo dd if=/dev/zero of=/swapfile bs=1M count=17408
sudo mkswap /swapfile
sudo chmod 600 /swapfile

2.- Activate swap persistently

echo "/swapfile none    swap    defaults 0 0" | sudo tee -a /etc/fstab
sudo mount -a

3.- Find out the UUID of the partition on which the swap file resides. We'll need this in later steps

findmnt -no UUID -T /swapfile

4.- Find out the swap file offset. We'll need this in later steps, too.

sudo filefrag -v /swapfile

NOTE: From this command's output, the first block of numbers from the "physical_offset" column is the value you need (only copy the numbers, and not the dots that follow the number block)

5.- Edit the /etc/default/grub file in order to boot with the "resume" and "resume offset" kernel parameters. In this file, at the end of the GRUB_CMDLINE_LINUX_DEFAULT line, before the ending ", add the following: resume=UUID=UUID_FROM_STEP_3 resume_offset=SWAP_OFFSET_FROM_STEP_4 (replace the values with the UUID you've got under step 3 and the swap resume offset you've got under step 4) For example, this is how the GRUB_CMDLINE_LINUX_DEFAULT line would look after adding the swap UUID and swap offset: GRUB_CMDLINE_LINUX_DEFAULT="quiet splash resume=UUID=4a59c6a7-ca54-4e24-a362-3eac83bfe226 resume_offset=4974592"

5BIS.-..and update the GRUB configuration. To do it on Debian-based Linux distributions, all you have to do is run the following command:

sudo update-grub

6.- Create (or edit if already exists) /etc/initramfs-tools/conf.d/resume with the swap UUID and resume offset (this is only on Debian-based Linux distribution...in RedHat's ones you should use Dracut). In this file, if you have a line beginning with "RESUME", edit that line, or if there's no such line (or the file is completely empty), add the line so that it looks like this: RESUME=UUID=UUID_FROM_STEP_3 resume_offset=SWAP_OFFSET_FROM_STEP_4

6BIS.- ...and regenerate initramfs using this command:

sudo update-initramfs -c -k all

7.- Reboot your computer. After rebooting, hibernate your computer using the following command:

sudo systemctl hibernate