Recover hiberfil.sys data
January 8, 2006 3:51 PM Subscribe
WinXP SP2: Forcing hibernate to resume from old hiberfil.sys
We lost many many hours of work in a power outage. However the computer was hibernated (and resumed) only an hour beforehand. The data is still in hiberfil.sys I assume (it was in an open program), but I have no idea how to force the computer to load from that. Any ideas or experience? Google-fu is failing me.
We lost many many hours of work in a power outage. However the computer was hibernated (and resumed) only an hour beforehand. The data is still in hiberfil.sys I assume (it was in an open program), but I have no idea how to force the computer to load from that. Any ideas or experience? Google-fu is failing me.
ie deleted after successful awakening
posted by andrew cooke at 4:29 PM on January 8, 2006
posted by andrew cooke at 4:29 PM on January 8, 2006
in other words, if you don't have it, but can recover it, then i think it may "just work"
posted by andrew cooke at 4:30 PM on January 8, 2006
posted by andrew cooke at 4:30 PM on January 8, 2006
Best answer: http://www.microsoft.com/resources/documentation/Windows/XP/all/reskit/en-us/Default.asp?url=/resources/documentation/Windows/XP/all/reskit/en-us/prmc_str_vzeb.asp
posted by andrew cooke at 4:31 PM on January 8, 2006
posted by andrew cooke at 4:31 PM on January 8, 2006
You may want to try making a backup copy of the old hiberfil.sys (which I assume you've done already), then hibernate the computer again. Next, boot the system using a diagnostic cd (such as this) and overwrite the newly created hiberfil.sys with the backup one. Then reboot and hopefully your computer will be sent back in time.
DISCLAIMER: I've never done anything like this. It may also take more than just restoring the hiberfil.sys to hibernate properly. Try to do a full backup before experimenting like this.
posted by cruelshooz at 4:34 PM on January 8, 2006
DISCLAIMER: I've never done anything like this. It may also take more than just restoring the hiberfil.sys to hibernate properly. Try to do a full backup before experimenting like this.
posted by cruelshooz at 4:34 PM on January 8, 2006
Response by poster: Yeah, I have the original hiberfil.sys, and i can find certain strings in it that I am sure it is the one we want. I've backed it up and I am going to go ahead and use Knoppix to try to swap the different files. I'll post and let ya know how it works.
posted by adzm at 5:16 PM on January 8, 2006
posted by adzm at 5:16 PM on January 8, 2006
Best answer: Your system will probably crash very soon after resuming from that hibernate file because the filesystem driver's state will be inconsistent with the filesystem on disk, and it will issue a kernel STOP error.
I don't think you'll be able to resume from this image, so your only option is to try and recover any plaintext strings from hiberfile.sys that may be useful to you.
posted by azazello at 8:23 PM on January 8, 2006
I don't think you'll be able to resume from this image, so your only option is to try and recover any plaintext strings from hiberfile.sys that may be useful to you.
posted by azazello at 8:23 PM on January 8, 2006
Response by poster: azazello is pretty much right. After playing around with forcing sleeps, linux boot disks and swapping hibernation files, I finally managed to get back into windows xp... for a few seconds. Then the kernel STOP comes.
It was fun trying, but not an endeavor I would ever recommend. Luckily the memory for the data was sequential, so recovering a lot of the strings wasn't too bad, and better than nothing. Thanks for all the help :)
posted by adzm at 4:48 AM on January 10, 2006
It was fun trying, but not an endeavor I would ever recommend. Luckily the memory for the data was sequential, so recovering a lot of the strings wasn't too bad, and better than nothing. Thanks for all the help :)
posted by adzm at 4:48 AM on January 10, 2006
This thread is closed to new comments.
posted by andrew cooke at 4:29 PM on January 8, 2006