My question is about storing hiberfil.sys
Is hiberfil.sys located in specific sectors each time that are overwritten when the computer hibernates, or does it just get written out to unallocated space - making multiple hibernate session ram dumps recoverable (if there is plenty of unallocated space on the hard drive)?
Thanks in advance for any info,
Dan
Dan,
Surely this is easy enough to test for yourself.
I don't know the answer though I could easily test it on the machines I have. Be aware however, that if (for example), you test it on Windows 7 Ultimate, will the results hold true for Windows XP? does it hold true for Windows Vista? or even Windows 7 Professional? You don't know until you test it for yourself (best option) or read it in a publication from a reputable source (like an academic journal)
Paul
Microsoft introduced “hibernate” option in Windows XP, 2000, and all Vista and later versions. This option allows the machine to power off and go to sleep and again resume at the precise point where it went to sleep. During this process all the contents of the RAM are written to a new file hiberfil.sys. hiberfil.sys contains the contents of RAM and is located in the root of the system. Also windows and other operating systems when they run out of RAM, they write some of the data that is in RAM to pagefile.sys. The basic difference between these two files is that the size of the pagefile.sys keeps on changing depending on the contents of the RAM cache, while the size of the hiberfil.sys is constant and depends on the actual size of the RAM in the system. And data in the hiberfil.sys is overwritten and located in particular sectors. I'm not 100% sure, but this might be the case as I learnt this from a reputable publication.
I'm not 100% sure, but this might be the case as I learnt this from a reputable publication.
So it needs testing right? (as per my previous post)
If not, perhaps we can take you at your word
Paul
And data in the hiberfil.sys is overwritten and located in particular sectors. I'm not 100% sure, but this might be the case as I learnt this from a reputable publication.
Thanks for the info. As binarybod said, it seems as though I'll have to test it myself. I'll try and remember to share my findings when I have the time to figure this one out.
I think you misunderstood. I believe binarybod was implying that you will learn more by testing it for yourself.
The behavior of hiberfil.sys is well documented online, for all the Windows operating systems.
Here is a tip - Since the hibernating feature can be turned on and off, what would happen, with the presumption that hiberfil.sys is sector specific, and the sectors are in use when hibernating is turned back on?
What would be the benefit to have hiberfil.sys sector specific? Remember, by the time hiberfil.sys is reloaded, the OS kernel is running.
Any results?
hi
That was a good question even iam interested to know ,
My opinion is Hiberfil.sys is a locked file , i dont think it uses multiple sectors ,
it uses the same sectors after hiberanted turned back on.The file size depends largely on the size of active RAM in the computer as the contents of the file are basically a RAM image.
When testing, it is worth checking time stamps of hiberfile.sys..
Especially when you wake up your machine.
An interesting thing occurs…
hi
That was a good question even iam interested to know ,
My opinion is Hiberfil.sys is a locked file , i dont think it uses multiple sectors ,
it uses the same sectors after hiberanted turned back on.The file size depends largely on the size of active RAM in the computer as the contents of the file are basically a RAM image.
What is the standard disk sector size?
What is the average hiberfil.sys file size?
Have you tested hibernate on, hibernate off, data added, hibernate on - and it went to the same sectors?