Also, if you run this
<?php
phpinfo();
?>
you will be able to check for whatever php extension you have installed on your server.
If you go down about 3/4 of the page, you will see the session directives. The latest Registered serializer handlers is php php_binary wddx.
Most PHP configuration will always have files as the default value for the session.save_handler directive. So, if you set the CI to save it to the database, then this directive will be overriden.
The session.save path is always defaulted to tmp directory. However, if you want to change this to some encrypted name, you are always welcome to do so, as long as you change the value on your php.ini file.
If you are using xampp or equivalent, you can literally view the sessions generated by PHP
For example, Symfony2 will generate a session text file inside the tmp directory similar to this.
logged|
b:0;id_user|
i:0;username|
s:0:"";privs|
i:0;email|
s:0:"";_symfony2|
a:3:{
s:10:"attributes";a:0:{}s:7:
"flashes";a:0:{}s:6:"locale";s:2:"en";}
does it look familiar? those are the same as the example above, but I would never post anything on how CI handles its session transactions.
Looking at the code above, it appears that this session belongs to the site admin of a Symfony2 website. The privs for the admin is 7, the user id of the admin is 6.
Can we fixiate this session ? Sure, middle school kids can probably figure this out in no time.