Improve company productivity with a Business Account.Sign Up

x
?
Solved

How to examine hiberfil.sys

Posted on 2009-05-12
8
Medium Priority
?
979 Views
Last Modified: 2012-05-06
I have had an issue booting by system vista x64 from hibernation, it appears to go through the process of restoring the hibernation status but does not restore and starts a new session,
I had a not pad file open but not savaed the contents how can examine the hiberfil.sys in order to recover my notes.
0
Comment
Question by:bourneisp_
  • 3
  • 3
  • 2
8 Comments
 
LVL 97

Expert Comment

by:Lee W, MVP
ID: 24369657
I don't think you're going to do it.  This is not a common practice.  The time and expense to get it done would probably be far more costly then reconstructing notes.

In short, I expect you'd need to use a byte level editor like WinHex and scan through it for text.  Good luck... it will be like finding a needle in a hay stack.
0
 
LVL 11

Expert Comment

by:kyodai
ID: 24369681
Well what leew said is somehow right. If you have the file just open it in some hex editor and enter a word or phrase you remember in the search dialog. However - as the hex editor does this for you you just need to wait for a minute and cross thumbs. I don't see why you shouldn#t give it a try. I use HxD as a hex editor which also works quite well for such large files.
0
 

Author Comment

by:bourneisp_
ID: 24369733
what about forceing windows to load the hiberfil.sys state.
0
Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

 
LVL 97

Expert Comment

by:Lee W, MVP
ID: 24369735
"somehow right"?  Strange, considering I don't have much experience...   8-)
0
 
LVL 97

Accepted Solution

by:
Lee W, MVP earned 750 total points
ID: 24369749
If you don't make a backup of it first, you could lose ALL chance of recovery.  Then (after the backup) I would hibernate the system so it knows it should resume again and then boot the system to a boot CD and replace the existing hiberfil.sys file with the one that wouldn't load.  But it's possible it's corrupt too... and simply won't load.

NOte: to make the backup, you may need to shutdown (not hibernate, boot to a boot CD and make the backup, since the file may well be locked while booted into windows).
0
 

Author Comment

by:bourneisp_
ID: 24369970
from what i can see it looks like when it has booted up it has created a new hiberfil.sys file at the created date and time if of my last boot up rather that the last time it was saved :(
0
 
LVL 11

Assisted Solution

by:kyodai
kyodai earned 750 total points
ID: 24370413
Yes if you have not saved that file it is unfortunately lost forever. As windows just overwrites the file you would need extended forensics to even have a remote chance of ever getting that content again. Sorry to say that, wish i could do more!
0
 

Author Closing Comment

by:bourneisp_
ID: 31580738
there was no solution to this as windows re-creates this file at start up
0

Featured Post

Upgrade your Question Security!

Your question, your audience. Choose who sees your identity—and your question—with question security.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

This tutorial is about creating a new Microsoft Online User Profile account along with how to transfer your files and settings. You may be faced with this situation if your existing user profile has become corrupted.
Read this tutorial to learn how to fix repeating password error prompts when setting up Gmail IMAP with Microsoft Outlook. The entire process is described with step by step, illustrated instructions. Enjoy...
As developers, we are not limited to the functions provided by the VBA language. In addition, we can call the functions that are part of the Windows operating system. These functions are part of the Windows API (Application Programming Interface). U…
If you’ve ever visited a web page and noticed a cool font that you really liked the look of, but couldn’t figure out which font it was so that you could use it for your own work, then this video is for you! In this Micro Tutorial, you'll learn yo…

579 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question