Windows hibernation and memory forensics