Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I put my computer in sleep mode yesterday, and when I turned it back on, a file had been rolled back to the state it was in when I initially turned the computer on for the first time that day. After some googling, I found that the file may still be accessible in hiberfil.sys, although it was not in hibernation mode specifically.

How can I get that file back, if that is even remotely possible? Am I looking at the wrong file? Is there a similar file for sleep mode?

share|improve this question

1 Answer 1

You may try looking at hiberfil.sys using the search function of a hex editor. This will probably only be a sane thing to do if it's a text file, and even then, there's no guarantee that the memory pages containing your file would be contiguous.

It's also more than very likely the program stores the data in RAM in a different format than what it would write to disk. So you would need to be intimately familiar with how that program is using that data in RAM.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.