0

I'm trying to make a backup copy of C:/hiberfil.sys without rebooting the system. So booting to a linux is not possible. The Windows system is currently running.

Running hobocopy c:\ e:\ hiberfil.sys outputs:

HoboCopy (c) 2006 Wangdera Corporation. [email protected]

Starting a full copy from c:\ to e:\
Creation of directory failed with error Access is denied.
 (Error number 5) on directory \\?\e:\

(I'm running the stable x64 hobocopy release.)

Going through some of the comments by the author on a thread here, I tried:

   icacls \hiberfil.sys /grant Administrator:(D,WDAC):

\hiberfil.sys: The process cannot access the file because it is being used by another process.
Successfully processed 0 files; Failed processing 1 files

   .. and attrib -h -s \hiberfil.sys1:

Unable to change attribute - C:\hiberfil.sys

   .. and psexec -s "%userprofile%/downloads\hobocopy-1.0.0.0-W2K3-Vista-x64-Release/hobocopy" C:\ e:\ hiberfil.sys:

PsExec v2.2 - Execute processes remotely
Copyright (C) 2001-2016 Mark Russinovich
Sysinternals - www.sysinternals.com


HoboCopy (c) 2006 Wangdera Corporation. [email protected]

Starting a full copy from C:\ to e:\
Creation of directory failed with error Access is denied.
 (Error number 5) on directory \\?\e:\
C:\Users\new2/downloads\hobocopy-1.0.0.0-W2K3-Vista-x64-Release/hobocopy exited on MQHPPV045TX2 with error code 1.

   .. and psexec -s %userprofile%/downloads\hobocopy-1.0.0.0-W2K3-Vista-x64-Release/hobocopy C:\ e:\f1 *.sys:

PsExec v2.2 - Execute processes remotely
Copyright (C) 2001-2016 Mark Russinovich
Sysinternals - www.sysinternals.com


HoboCopy (c) 2006 Wangdera Corporation. [email protected]

Starting a full copy from C:\ to e:\f1
Copy of file failed with error Access is denied.
 (Error number 5) on file \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy26\hiberfil.sys
C:\Users\new2/downloads\hobocopy-1.0.0.0-W2K3-Vista-x64-Release/hobocopy exited on MYWINDOWSCOMNAME with error code 1.

Nothing works.

I can copy c:\pagefile.sys simply using hobocopy c:\ e:\f1 hiberfil.sys without changing any access rights, but c:\hiberfil.sys just absolutely refuses to be copied.

Does SYSTEM even have permission to hiberfil.sys?

Anyone tried copying hiberfil.sys live before? Is this even possible?

4
  • 3
    Why do you want to copy hiberfil.sys? During hibernation it contains the contents of RAM. But the current contents is for all practical purposes just garbage. When going into hibernation a signature is written to the file marking it as valid. The signature is removed when Windows starts making the current file useless. While Windows is running the file is locked for exclusive access by the SYSTEM process. It is not a matter of permissions.
    – LMiller7
    Feb 14, 2017 at 2:16
  • @LMiller7, I need to analyze the contents of the RAM. See superuser.com/a/793020/78897 for an example, my case is different but similar to the method described there.
    – Pacerier
    Feb 14, 2017 at 14:02
  • I had ran ps using SYSTEM yet it doesn't work. (see the output of the cmd above). Are you sure it's locked for exclusive access by SYSTEM or is it something else.. Does SYSTEM even have permission to hiberfil.sys?
    – Pacerier
    Feb 14, 2017 at 14:03
  • The SYSTEM process, not account, has created and owns a lock on hiberfil.sys giving it exclusive access. Other processes running under the SYSTEM account do not own the lock and have no access. Locks are owned by processes, not accounts. File locking is quite different from file permissions.
    – LMiller7
    Feb 14, 2017 at 15:46

1 Answer 1

3

author of hobocopy here.

There is a registry entry that controls which files the Volume Shadow Service (which hobocopy and shadowspawn use) ignores. Examples include .ost files. See https://msdn.microsoft.com/en-us/library/windows/desktop/aa819132(v=vs.85).aspx.

As I am not on a Windows box any more, I'm not sure whether this is your problem. But I strongly suspect that copying hiberfil.sys is outside the scope of what VSS is designed to do, so there may not be a way to do it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .