1. What would you routinely expect to find in the hibernation file as opposed to the pagefile?
2. Is it true that the largest size of any individual file in the pagefile is 4kb?
3. How are these files changed after each boot?
1. What would you routinely expect to find in the hibernation file as opposed to the pagefile?
A hibernation file is a snapshot of system state, and is used to restore that system state for continued processing.
A page file contains that part of virtual memory that isn't resident at any given moment plus a number currently unused pages. The key to interpreting a page file is to have the memory management data structures, which usually are in-core, I think.
2. Is it true that the largest size of any individual file in the pagefile is 4kb?
For some value of true, and some value of 'file'.
A page file contains memory pages that have 'paged out' to make place for other data, and that cannot be be restored from other sources. This usually means data, not code. Thus, 'file' is a bit of misnomer.
And the size of a memory page is whatever the current operating system / virtual memory manager decides or is configured to use. If you're on a system with a particular MMU hardware unit, that may decide if you have any choices regarding size. For most current-day operating systems 4kibytes is standard, but there usually are possibilities for other sizes as well.
For Unix-based operating systems, there is quite often a 'getpagesize()' system call – and there are often command line utilities (such as getpagesize(1)) to retrieve the information.
3. How are these files changed after each boot?
'each boot'?
That may depend on operating system and on the configuration of that operating system. Haven't researched the issue.
Hibernation file need not change at all.
Page file changes due to what programs are run at the same time, and their need for virtual memory space, and if that accumulated need exceeds physical memory size or not. If you have lots and lots of RAM, it may not change – but that is almost certainly OS dependent.
Even if you never use the Hibernate function on your PC, is information still being written to the Hibernation file? If so how often is the system snapshot taken and does it overwrite the previous or will you find a selection of system snapshots there?
Even if you never use the Hibernate function on your PC, is information still being written to the Hibernation file?
That's one of those question that shouldn't be answered unless there's actual research behind it.
I would be surprised if it was it would be a waste of computer power, as well as a potential security problem, as the user would not be able to know if something sensitive was saved.
The only reason for sych saves to happen would be if hibernation was some kind of 'save you if a catastrophe happens'. It isn't.
If hibernation data is saved only at well-defined actions (giving a command, closing laptop lid, pressing a key, etc.) its better all around.
Further research into this has found the hibernation system file is continuously being written to while it is active - so it will contain a live system image at any one time
Further research into this has found the hibernation system file is continuously being written to while it is active - so it will contain a live system image at any one time
The file being continuosly written/accessed/whatever does not necessarily imply that it will contain a "live system image" at any time, and its contents may be different on different OS releases
http//
jaclaz