The sleepimage is a file that Mac OS X uses to store the contents of the active RAM when a machine is put to sleep. This information is stored to allow the OS to restore the pre-sleep state of the computer should the batter or power be interupted while the computer is sleeping.
For an investigator, the sleepimage may contain information that could be valuble to an investigation. This information may show what a suspect was doing before they put their computer to sleep and may include incriminating evidence that could lead to a conviction.
The sleepimage file can be found in the following location in the Mac OS X system:
/private/var/vm/sleepimage
Please note that this is an hidden file that isn't normally visible from the Finder. Computer forensics programs such as MacForensicsLab can be used to view the sleepimage location and the contents of the sleepimage file.
