<div>
The modified date should be that of the last login. You can try and find the modified date on the user's profile, that matches and that should do it... <br />
<br />
You realize thats a hibernation file, right?
</div>


<div>
I dont fully understand. The modified date was at the start of the last login. Shouldn't the hibernation file relate to a login before that? Why does the hibernation file have a creation date several days earlier?
</div>


<div>
Still not sure how you are going to utilize it......
</div>


<div>
Gklad you got the answer... Still curious to see how you are going to open that file? Have you found a way?
</div>


<div>
<div class="content wysiwyg-content">
I have a hiberfil.sys file with data preserved in it. The file was modified 31 August and created 27 August. I need to know to what login the data relates. The last logon was 31 August. Is the data in hiberfil.sys related to the logon immediately prior to the last 31 Augustlogin, the logon on 27 August or an indeterminate logon between 27 August and 31 August?
</div>
</div>


I have a hiberfil.sys file with data preserved in it. The file was modified 31 August and created 27 August. I need to know to what login the data relates. The last logon was 31 August. Is the data in hiberfil.sys related to the logon immediately prior to the last 31 Augustlogin, the logon on 27 August or an indeterminate logon between 27 August and 31 August?

Is the data in hyberfil.sys the last login or the login when the file was created?

The Microsoft Legacy Operating System topic includes legacy versions of Microsoft operating systems prior to Windows 2000: All versions of MS-DOS and other versions developed for specific manufacturers and Windows 3/3.1, Windows 95 and Windows 98, plus any other Windows-related versions, and Windows Mobile.