2

Is it possible to copy hibernation or paging file on a live system?

I tried to use Hobocopy.exe like this:

hobocopy.exe c:\ c:\temp hiberfil.sys

..but it does not work.

Using the same hobocopy and the same syntax, I'm able to copy registry files (e.g. SOFTWARE file).

Does hiberfil.sys differ from other system files and is "more locked" by a system?

Is there any way to copy the files without rebooting?

1

3 Answers 3

1

These files are locked more by the system, and that is the reason you can't copy them. I can't imagine any reason you'd have for trying to copy them either, the data contained within is entirely invalid except on the live system itself.

2
  • 1
    The data is useful for many things. For example, searching through your lost data e.g. superuser.com/a/793020/78897
    – Pacerier
    Feb 13, 2017 at 23:30
  • I can help you to imagine: "Digital Forensic analysis" for example..
    – f4d0
    Apr 8, 2019 at 14:06
1

I'm guessing this is a permissions problem, and that even administrators don't have permissions to access this file. Shadow copies of files have the same ACLs as the files they shadow.

What's the particular error you're getting? Can you try

hobocopy /verbosity=4 C:\ C:\temp hiberfil.sys 

And comment with the results? Assuming it's error 5, you're going to have to either change permissions on the file or run hobocopy as a user that has access permission. Presumably that's SYSTEM. One way to run things as system (there are several) is to use the psexec program and specify the -s option. Something like this:

psexec -s hobocopy C:\ C:\temp hiberfil.sys

You can get psexec from Sysinternals.

15
  • Thanks, Craig. Indeed, the initial error was 5. However, using psexec did not help. It now issues error 0 but nothing is copied: Starting a full copy from C:\ to L:\Temp\h Copied directory Backup successfully completed. Backup started at 2011-03-17 01:05:15, completed at 2011-03-17 01:07:16. 0 files (0.00 bytes, 1 directories) copied, 2727 files skipped
    – Alex
    Mar 16, 2011 at 22:10
  • Weird - it's almost like it didn't match the name of the file. Can you verify that the file is spelled correctly? Also, I'd love to see the output of psexec -s hobocopy /vebosity=4 C:\ L:\Temp\h. Mar 17, 2011 at 11:33
  • Also, it might be best to move this conversation to [email protected], since I don't always remember to check back here. Mar 17, 2011 at 11:34
  • I thought of another idea: try psexec -s hobocopy C:\ C:\temp *.sys just to see if it can match by wildcard. Mar 17, 2011 at 11:35
  • Is it possible to tell hobocopy not to go through subfolders, something like /norecurse? It takes too long to wait for its completion especially in verbose mode while I only need to copy a single file.
    – Alex
    Mar 18, 2011 at 8:47
0

This worked for me, from an Administrator cmd prompt, so it is possible:

HoboCopy.exe C:\ C:\pf pagefile.sys

HoboCopy (c) 2011 Wangdera Corporation. [email protected]

Starting a full copy from C:\ to C:\pf
Copied directory
Backup successfully completed.
1 files (2.0 GB, 1 directories) copied, 25 files skipped
1
  • It workks for pagefile.sys but does not* work for hiberfil.sys. See related serverfault thread linked above.
    – Pacerier
    Feb 13, 2017 at 23:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .