Recover hiberfil.sys data

January 8, 2006 3:51 PM

WinXP SP2: Forcing hibernate to resume from old hiberfil.sys

We lost many many hours of work in a power outage. However the computer was hibernated (and resumed) only an hour beforehand. The data is still in hiberfil.sys I assume (it was in an open program), but I have no idea how to force the computer to load from that. Any ideas or experience? Google-fu is failing me.

posted by adzm to computers & internet (8 comments total)

do you actually have the hiberfil.sys? because reading around i get the impression it's deleted (conversely, if it's not deleted, the boot loader boots from it rather than boot.ini).
posted by andrew cooke at 4:29 PM on January 8, 2006

ie deleted after successful awakening
posted by andrew cooke at 4:29 PM on January 8, 2006

in other words, if you don't have it, but can recover it, then i think it may "just work"
posted by andrew cooke at 4:30 PM on January 8, 2006

http://www.microsoft.com/resources/documentation/Windows/XP/all/reskit/en-us/Default.asp?url=/resources/documentation/Windows/XP/all/reskit/en-us/prmc_str_vzeb.asp
posted by andrew cooke at 4:31 PM on January 8, 2006

You may want to try making a backup copy of the old hiberfil.sys (which I assume you've done already), then hibernate the computer again. Next, boot the system using a diagnostic cd (such as this) and overwrite the newly created hiberfil.sys with the backup one. Then reboot and hopefully your computer will be sent back in time.

DISCLAIMER: I've never done anything like this. It may also take more than just restoring the hiberfil.sys to hibernate properly. Try to do a full backup before experimenting like this.
posted by cruelshooz at 4:34 PM on January 8, 2006

Yeah, I have the original hiberfil.sys, and i can find certain strings in it that I am sure it is the one we want. I've backed it up and I am going to go ahead and use Knoppix to try to swap the different files. I'll post and let ya know how it works.
posted by adzm at 5:16 PM on January 8, 2006

Your system will probably crash very soon after resuming from that hibernate file because the filesystem driver's state will be inconsistent with the filesystem on disk, and it will issue a kernel STOP error.

I don't think you'll be able to resume from this image, so your only option is to try and recover any plaintext strings from hiberfile.sys that may be useful to you.
posted by azazello at 8:23 PM on January 8, 2006

azazello is pretty much right. After playing around with forcing sleeps, linux boot disks and swapping hibernation files, I finally managed to get back into windows xp... for a few seconds. Then the kernel STOP comes.

It was fun trying, but not an endeavor I would ever recommend. Luckily the memory for the data was sequential, so recovering a lot of the strings wasn't too bad, and better than nothing. Thanks for all the help :)
posted by adzm at 4:48 AM on January 10, 2006