Why does hiberfil.sys come back from the dead on Windows 7?

Question

I have Windows 7 running on a small (40GB) partition, with 4GB ram. This means that the hiberfil.sys file created by Hibernate takes up a significant portion of the available diskspace. I would like to remove it.

I am aware that I can disable Hibernate and remove hiberfil.sys by entering powercfg -h off in an elevated command prompt. This works -- the file is immediately removed, and after doing so, the HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Power\HibernateEnabled key is (correctly) set to 0.

However, the next time I reboot the PC, hiberfil.sys returns from the dead, Hibernate is reenabled, and that registry key has returned to 1.

I'm pretty much at my wits' end with this. Almost everything I can find online related to removing the hiberfil.sys file simply suggests using powercfg to turn off hibernation, and that appears to work for just about everyone. But it just keeps coming back for me! (Like a vampire, sucking up my disk space.) I did find one other thread from someone who seems to have had the same issue, but none of the suggestions there worked for the original poster (or for me). Still, I have tried everything listed there, including:

• Disabling hybrid sleep

• Disabling Hibernate through the command prompt, through the Power Options GUI, and through both (in both orders)

• Manually changing the HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Power\HibernateEnabled key

• Pretty much everything else I can think of!

I do want to reiterate that I have no problem removing the file -- that works great. It just comes back after every reboot. I'm about ready to throw in the towel and just run a script on login to disable Hibernate each time, even though that seems like a crazily hacky "solution" . . . but I was hoping someone here could suggest something else, first.

Thanks!

Answer 1

You can easily troubleshoot this with Process Monitor.

Start it and enable Boot Logging in the Tools menu, restart your computer and start Process Monitor.

Then, let it stop capturing and then search for HibernateEnabled and check what changed the value.

---

For more advanced insights, this can also be done with XBootMgr from the Windows Performance Toolkit.

Installation Instructions - On/Off Transition Performance Analysis Document

Answer 2

My Windows 7x64 install is on an SSD partition on a Mac laptop. I've disabled with powercfg /h off (elevated) and ms fixit's disable hibernate, as well as the setting registry key HibernateEnable value to 0. Hiberfil.sys is deleted only until reboot. When I boot native hiberfil.sys is always re-created, but when I boot inside OS X and VMware Fusion, the hibernation stays disabled, as it should.

Tom Wijsman's suggestion of ProcessMonitor with boot logging helped me find that vmtoolsd.exe (from VMware) was re-enabling the registry key during the native boot. I tried to change the permissions in regedit, but they did not stop the value change to 1. I thought about creating a small hiberfil.sys, but I think that would ave been overwritten.

As a 99% solution, I changed the HiberFileSizePercent value to decimal 1, which makes the hiberfil.sys only 80MB on an 8GB RAM machine. I suppose I could try .001 or less, but 80MB is not much.

Answer 3

You could try to turn hibernate on and off again. In cmd "Run as Administrator" do :

powercfg.exe /hibernate on
powercfg.exe /hibernate off
del c:\hiberfil.sys

If you are using a laptop, then after turning hibernate on and before turning it off, do also the following :

1. Ensure that hybrid sleep is disabled.
2. Power Options → Change plan settings → Change advanced power settings, expand Sleep and change the value of "On battery" and "Plugged in" to 0 minutes.

Answer 4

same thing here!

out of frustration, I even configured the local policy such that it would run a cmd on machine startup that would run the powercfg line, but even that's not good enough!

this is really frustrating since I'm running Win7 Ultimate on a 60 GB partition.

in my next experiment I shall toy with the "HiberFileSizePercent" registry key under:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power

and see if that might force it to (re-)create a smaller file at least.

f.

Answer 5

Maybe manually recreate it after the removal and set permissions to disallow the system to modify the file? I know, it's a long shot.

Could this be caused by a restore partition or similar?

Answer 6

I had the same problem. Tried:

powercfg –H OFF

Set HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Power\HibernateEnabled

Set Control Panel\All Control Panel Items\Power Options\Edit Plan Settings for Never for all power options.

And the file kept coming back to life. The advice of using process monitor did the trick for me. The system I use has "Pointsec for PC" installed, and the prot_srv.exe process kept resetting this value. Given this PC is locked down with this software, there is not much I can do.

Answer 7

Half answer:

On Windows XP, this was an easy and permanent solution:

1. delete hiberfil.sys with this command (with admin rights): powercfg -h off

2. create a folder called "hiberfil.sys" at C:\

Unfortunately, Win7 is "smarter" than XP, and kills this folder, ignoring any ownership/permission combination I tried. But sometimes my hiberfil.sys folder survived a single restart without being replaced. It is also interesting that the system seemed to regenerate the original file after a few seconds the the window of C:\ appeared on the desktop.

And thank you for my first downvote :)