Comments on: Recover hiberfil.sys data

Question: Recover hiberfil.sys data

adzm — Sun, 08 Jan 2006 15:51:20 -0800

WinXP SP2: Forcing hibernate to resume from old hiberfil.sys

We lost many many hours of work in a power outage. However the computer was hibernated (and resumed) only an hour beforehand. The data is still in hiberfil.sys I assume (it was in an open program), but I have no idea how to force the computer to load from that. Any ideas or experience? Google-fu is failing me.

By: andrew cooke

andrew cooke — Sun, 08 Jan 2006 16:29:39 -0800

do you actually have the hiberfil.sys? because reading around i get the impression it's deleted (conversely, if it's not deleted, the boot loader boots from it rather than boot.ini).

By: andrew cooke

andrew cooke — Sun, 08 Jan 2006 16:29:59 -0800

ie deleted after successful awakening

By: andrew cooke

andrew cooke — Sun, 08 Jan 2006 16:30:29 -0800

in other words, if you don't have it, but can recover it, then i think it may "just work"

By: andrew cooke

andrew cooke — Sun, 08 Jan 2006 16:31:15 -0800

http://www.microsoft.com/resources/documentation/Windows/XP/all/reskit/en-us/Default.asp?url=/resources/documentation/Windows/XP/all/reskit/en-us/prmc_str_vzeb.asp

By: cruelshooz

cruelshooz — Sun, 08 Jan 2006 16:34:21 -0800

You may want to try making a backup copy of the old hiberfil.sys (which I assume you've done already), then hibernate the computer again. Next, boot the system using a diagnostic cd (such as this) and overwrite the newly created hiberfil.sys with the backup one. Then reboot and hopefully your computer will be sent back in time.

DISCLAIMER: I've never done anything like this. It may also take more than just restoring the hiberfil.sys to hibernate properly. Try to do a full backup before experimenting like this.

By: adzm

adzm — Sun, 08 Jan 2006 17:16:14 -0800

Yeah, I have the original hiberfil.sys, and i can find certain strings in it that I am sure it is the one we want. I've backed it up and I am going to go ahead and use Knoppix to try to swap the different files. I'll post and let ya know how it works.

By: azazello

azazello — Sun, 08 Jan 2006 20:23:23 -0800

Your system will probably crash very soon after resuming from that hibernate file because the filesystem driver's state will be inconsistent with the filesystem on disk, and it will issue a kernel STOP error.

I don't think you'll be able to resume from this image, so your only option is to try and recover any plaintext strings from hiberfile.sys that may be useful to you.

By: adzm

adzm — Tue, 10 Jan 2006 04:48:38 -0800

azazello is pretty much right. After playing around with forcing sleeps, linux boot disks and swapping hibernation files, I finally managed to get back into windows xp... for a few seconds. Then the kernel STOP comes.

It was fun trying, but not an endeavor I would ever recommend. Luckily the memory for the data was sequential, so recovering a lot of the strings wasn't too bad, and better than nothing. Thanks for all the help :)