up vote 2 down vote favorite
share [g+] share [fb]

I'm currently wondering about the place that Windows (XP, Vista, 7) store information like "Windows is running" and so on. I mean, somehow Windows knows when you just power-down your computer that it was running before. The bootloader somehow also knows that there is a memory image in hiberfil.sys and not just empty garbarage.

I would guess its the registry, but where exactly?

link|improve this question
It's quite certainly NOT the registry. Bootloaders are simple beasts, and the registry is a complex data structure. I'd bet it's stored in hiberfil.sys directly. – MSalters Dec 2 '11 at 19:08
Well theres not always a hiberfil.sys... I mean, the bootloader can even change the registry ("last good configuration")... so why not? – csde_rats Dec 2 '11 at 21:02
1  
@csde_rats: Nope. The boot loader reads it and then passes the information to NTOS kernel, which changes the registry. – surfasb Dec 3 '11 at 1:32
Okay, well then the kernel must somewhere store such information... I just want to know where ;) – csde_rats Dec 3 '11 at 10:47
Well, if there's no hiberfil.sys, it's fairly easy to deduce that it doesn't contain a memory image ;) – MSalters Dec 5 '11 at 8:11
feedback

1 Answer

up vote 1 down vote

This is a must-read: Windows NT Startup Process (Wikipedia)

Also this: Detailed info about the Windows startup process

When there's a forced shutdown (ex. hold the power button for 5 seconds), Windows does not get a chance to save information about its state. When Windows attempts to start up again, it can see this in the registry and prompt you about booting into safe mode.

There is likely some kind of header or flag in the hiberfil.sys file, indicating whether or not it is a valid memory image.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.