[Webinar] Streamline your web hosting managementRegister Today

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 965
  • Last Modified:

How to examine hiberfil.sys

I have had an issue booting by system vista x64 from hibernation, it appears to go through the process of restoring the hibernation status but does not restore and starts a new session,
I had a not pad file open but not savaed the contents how can examine the hiberfil.sys in order to recover my notes.
0
bourneisp_
Asked:
bourneisp_
  • 3
  • 3
  • 2
2 Solutions
 
Lee W, MVPTechnology and Business Process AdvisorCommented:
I don't think you're going to do it.  This is not a common practice.  The time and expense to get it done would probably be far more costly then reconstructing notes.

In short, I expect you'd need to use a byte level editor like WinHex and scan through it for text.  Good luck... it will be like finding a needle in a hay stack.
0
 
kyodaiCommented:
Well what leew said is somehow right. If you have the file just open it in some hex editor and enter a word or phrase you remember in the search dialog. However - as the hex editor does this for you you just need to wait for a minute and cross thumbs. I don't see why you shouldn#t give it a try. I use HxD as a hex editor which also works quite well for such large files.
0
 
bourneisp_Author Commented:
what about forceing windows to load the hiberfil.sys state.
0
Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

 
Lee W, MVPTechnology and Business Process AdvisorCommented:
"somehow right"?  Strange, considering I don't have much experience...   8-)
0
 
Lee W, MVPTechnology and Business Process AdvisorCommented:
If you don't make a backup of it first, you could lose ALL chance of recovery.  Then (after the backup) I would hibernate the system so it knows it should resume again and then boot the system to a boot CD and replace the existing hiberfil.sys file with the one that wouldn't load.  But it's possible it's corrupt too... and simply won't load.

NOte: to make the backup, you may need to shutdown (not hibernate, boot to a boot CD and make the backup, since the file may well be locked while booted into windows).
0
 
bourneisp_Author Commented:
from what i can see it looks like when it has booted up it has created a new hiberfil.sys file at the created date and time if of my last boot up rather that the last time it was saved :(
0
 
kyodaiCommented:
Yes if you have not saved that file it is unfortunately lost forever. As windows just overwrites the file you would need extended forensics to even have a remote chance of ever getting that content again. Sorry to say that, wish i could do more!
0
 
bourneisp_Author Commented:
there was no solution to this as windows re-creates this file at start up
0

Featured Post

Get your problem seen by more experts

Be seen. Boost your question’s priority for more expert views and faster solutions

  • 3
  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now