The .restore file format is a custom format, specifically developed for hashcat.

hashcat supports resuming cracking jobs for every hash type and attack mode. Candidates piped in on stdin are the exception, because hashcat never advances the restore point for them. You need a .restore file containing the information required to continue, as well as the directories, dictionaries, masks, rules, hashes and hash files used in the original job. You can resume whether the job stopped because of a power failure or because you stopped it yourself.

It's important to know that the .restore file will be updated whenever this line in the status screen changes:

Restore.Point....:

… and not whenever this line changes (hashcat needs to reach the next restore checkpoint):

Progress.........:

To stop hashcat after the restore file has been updated, press 'c' to use the Checkpoint stop feature. Pressing 'q' quits immediately and can lose progress made since the last update.

Both keys are read once the run is under way. In 8.0.0 a key pressed during startup, while devices are being set up and kernels built, is discarded, so a signal is the only way out of a start you want to abandon. Applies to master. The 'q' key is honoured during startup as well.

The .restore file is automatically deleted when the full cracking job finishes (exhausted) or every hash in the hash list has been cracked.

To disable the restore support you can use --restore-disable. If you want to specify a different path to the restore file you can use --restore-file-path.

Suppose you used this command line to start a cracking job:

hashcat -m 0 -a 3 --session session_name example0.hash masks/rockyou-7-2592000.hcmask

and pressed 'c' (or 'q' to quit) while it was running, or the job stopped for another reason.

--restore shows you the command line the session was started with, and stops:

hashcat --session session_name --restore

To resume, repeat that command line and add --restore-position. This reads the saved position from the file and runs the command line you typed:

hashcat -m 0 -a 3 --session session_name --restore-position example0.hash masks/rockyou-7-2592000.hcmask

A restore file contains a whole command line. Previously, parsing it allowed a file you did not write to select any hashcat option. You now supply the command line yourself and may change it between runs. However, the saved position is meaningful only for the same attack with the same input. Changing the wordlist or mask can resume at an unintended position. analyze_hc_restore is still useful for inspecting the file.

Also have a look at the FAQ section about the restoring feature.

.restore files are binary files. To view their contents, use a hex editor or a tool that displays them in a human-readable format (such as https://github.com/philsmd/analyze_hc_restore ).

struct restore_data
{
  int  version;
  char cwd[256];
 
  u32  dicts_pos;
  u32  masks_pos;
 
  u64  words_cur;
 
  u32  argc;
  char **argv;

} restore_data_t;

Note: the .restore file has no fixed length. The total number of arguments and the length of each argument determine the total length of the .restore file. The number of arguments (argc) should not exceed 250.

Note 2: There are gaps in the restore structure because the format does not use packed alignment (__attribute__((packed))). Use the offsets exactly as listed in the table above.