Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 2 down vote favorite

I just powered on my system from hibernation and I accidentally deleted an unsaved work. My system is still on with the hibernation file still in use.The unsaved work is actually a write up on my site that I didn't upload online

share|improve this question
1  
You mean run a hexeditor or load the hiber into a text editor and use search to try and find the data that was stored in ram? Interesting. The reason I said hex editer, is because some of them will pour through a file without trying to load it all into memory (like a disk editer). – Psycogeek Jan 28 '12 at 20:57
1  
That certainly sounds like what is happening. This will only work if the editor was open and had the file loaded when the system hibernated, and then, only if the editor happened to have the doc in memory (a fairly good chance if it is just a bit of text) as opposed to say, a memory-mapped file or streaming or something, but still, only if it was in physical RAM rather than the pagefile, and finally, only if the editor kept the document in plain, continuous format (not encoded, fragmented, or in OOP structures). In other words, it may be possible to do this, but the odds are not good. – Synetech Jan 29 '12 at 6:00

2 Answers

up vote 3 down vote

It does not make sense rebooting from an hibernation file if your system state has already been changed, it will simply introduce inconsistencies between the stored memory and the MFT / registry and other saved data.

You are better of trying to just undelete the file using something like TestDisk. Alternatively you could try to recover it by searching the file, this is however unfeasible as it would be fragmented. Memory is random access in comparison to sequential storage on a hard disk...

As with any recovery attempt, stop writing to the disk. Rebooting in Safe Mode with the tools on a thumb drive (downloaded using private mode) might be worth it...

share|improve this answer
up vote 2 down vote

You can try to boot with a linux livecd (DSL) and rename hiberfil.sys, boot Windows, hibernate, boot again with live cd and delete new hiber.sys and rename the old one back; and boot Windows again from the hiberfil.sys .

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.