1

So I just ran a scan on my computer with WinDirStats and I realized I have this file called hiberfil.sys and that it was quite big. 13GB(12.7) so I started googleing about the specific file and I found things like

Hibernation copies everything stored in the computer’s memory and writes it to your hard drive

This thought might be kinda far fetched but what if I have pictures of me and my family and w/e stores in the memory and then someone hijacks my computer and get's ahold of it? Wouldnt it be safer to just delete the file?

  • 1
    If someone had your computer it would be simpler for them to look in the regular file system. If you hibernate your computer, the hiberfil is how it does it. If you throw it away the system will make a new one. – Tetsujin Jan 11 '17 at 11:33
2

Yes, hiberfil.sys is the memory image used for 'Hibernate' and 'Hybrid Sleep' features.

This thought might be kinda far fetched but what if I have pictures of me and my family and w/e stores in the memory and then someone hijacks my computer and get's ahold of it?

But you'd usually save those pictures to disk anyway, wouldn't you? So if someone steals the computer and is able to read the hibernation image... then they could just as easily read all other files you have there. It is much simpler to browse C:\Users\Jonny\Photos than rummage around bits in the RAM. (Not that it'll have much anyway.)

And if you want to avoid that, the only reliable solution is disk encryption – e.g. BitLocker.


You cannot delete hiberfil.sys manually – to do that, you'd need to disable hibernation in Windows' "Power saving" settings. (This of course also disables hybrid sleep. You'll still be able to use the regular RAM-only suspend mode.)

| improve this answer | |
  • You can't disable it through the GUI: Open a Command prompt window "as administrator" and run the command "powercfg -H off". This will also remove the file itself. – Tonny Jan 11 '17 at 12:09
0

It IS a security risk. In an scenario where you maintain your HDD free of sensible information, there may be a situation where a clever attacker may get info from the hiberfil, however, most times this info is also available in your HDD, unless you're a very carefull person. Anything that is in your RAM when you hibernate your computer will go to hiberfil, so be carefull. There may be a private key, an ID cookie, whatever.

As a curiosity, in a security class at the university, we had to use a dump file from a linux machine (which is kinda the same than hiberfill) to search for usernames and passwords. It doesnt look like a normal text file, but binary files can be read with specific software.

There's nothing wrong about removing hiberfill, the only downside is that you wont be able to hibernate your computer.

On every Windows machine, you can disable hibernation with the command:

powercfg.exe /hibernate off

Or enable it with

powercfg.exe /hibernate on

Both need administrative privileges (run CMD as Admin and then paste the command)

By default, I disable hibernation on every computer I put my hands on.

| improve this answer | |
  • 1
    Aren't you confusing hiberfil.sys with pagefile.sys? The former is only used as a hibernation image, while the latter is for swap/paging ("virtual memory"). – user1686 Jan 11 '17 at 12:00
  • @grawity My though exactly. This whole answers talks about pagefile.sys and the dangers of removing it. – Tonny Jan 11 '17 at 12:07
  • oh my god yes i did xD – DGoiko Jan 11 '17 at 15:51
  • okey, corrected it xD – DGoiko Jan 11 '17 at 15:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.