7

I'm trying to move the hibernate file from system partition (SSD) to some other partition (HDD).

I know a lot of people say this is impossible, but I'm not completely convinced yet.

What I'm trying to do is:

  1. Boot up from Windows 7 DVD;
  2. Copy hiberfil.sys from SSD to HDD;
  3. Delete hiberfil.sys from SSD;
  4. Create a symbolic link for hiberfil.sys on SSD;

Unfortunately, when I boot up from Windows 7 DVD, I sadly found the hiberfil.sys file was not there. I remember I have read somewhere that Windows automatically deletes the hiberfil.sys file when shut down.

Is it possible to prevent Windows from deleting hiberfil.sys file when shut down?

Thanks


Update:

It seems Windows actually doesn't delete hiberfil.sys file when shut down. It was the VMware Tools automatically disabled hibernate when shut down / start up.

4
  • Why do you need hibernation on a SSD? It would be more cost efficient to just use sleep or shutdown instead. Apr 6, 2011 at 19:23
  • 1
    @Tom Wijsman: I'm using APC PowerChute. It requires hibernate be enabled, so that it can automatically puts my PC into hibernation after power cut.
    – user68795
    Apr 6, 2011 at 19:38
  • Ah, makes sense then. Well, a power cut is most likely once a year so there is no worry... :) Apr 6, 2011 at 19:43
  • 4
    @TomWijsman the frequency of power outages can vary greatly depending on where you are, especially in developing countries
    – Xantec
    Apr 6, 2011 at 21:49

2 Answers 2

5

No, you can't move it.

During boot time Windows (and your BIOS) uses a minimal file I/O system to locate the boot drive and files needed to finish the boot (including the file-system drivers). Since the hibernation file contains system state before shutdown, it's needed actually boot to the 'full' file system.

If you've been around since the DOS days, you may remember having to use "SYS" to make a disk bootable; you couldn't just copy the boot files (msdos.sys, io.sys, etc.) to the disk and have it work, becuase they need(ed) to be at a specific address on the disk so the system knew where to find them to boot the actual OS. Same deal here...

Here's a good blurb about it:

Hibernation follows a similar pattern. Hibernating the operating system means dumping the entire contents of memory into the hibernation file; restoring from hibernation entails sucking that file back into memory and pretending nothing happened. Again, it's another chicken-and-egg problem: to load the hibernation file, you need the file system driver, but the file system driver is in the hibernation file. If you keep the hibernation file in the root directory of the boot drive, the miniature file system driver can be used instead.

You can read the rest of the article here.

9
  • 1
    @techie007, thanks for your detailed answer and the link. Now I'm completely convinced :)
    – user68795
    Apr 6, 2011 at 18:46
  • 1
    @caveman: That article is from 2007. That was in the early XP Vista times and that article is most likely referring to Windows XP which is unsupported by now. Windows 7 has been released in late 2009 so you shouldn't really trust such an old link, give it a try because the current structure might allow for symbolic links or changing the path in the registry. Apr 6, 2011 at 18:57
  • 3
    @Tom Wijsman - It still holds true. Here's references from a MS MVP in 2009, in regards to Windows 7 specifically: social.technet.microsoft.com/Forums/bg-BG/w7itproui/thread/… - he links back to that same article. I think the problem you're going to find with hard-links is that they don't exist until the file-system is running, which would be after the hibernaiton file has been used to boot. Apr 6, 2011 at 19:03
  • 2
    @Tom Wijsman - I'm aware an MVP isn't an actual MS rep. But they're usually more in-the-know when it comes to their favorite MS technologies than the average dude on the Internet. The xbootmgr tracing is for checking system performance while going in to and coming out of ACPI sleep states (and how long they were in those states). The trace doesn't start/continue until after the hibernation file has been mounted and the OS is running again. Apr 6, 2011 at 19:31
  • 2
    @techie007: Sorry for playing devil's advocate. A MS rep explanation from the Windows Internals book can be found in my answer and tracing it as you did are two up-to-date ways to verify that it's impossible in that way, the only thing that is left to try is to change that registry location as it most likely is there for a reason... Apr 6, 2011 at 19:50
2

Disallowing deletes (if there is a SID)

First make sure that hiberfil.sys isn't inheriting permissions, be sure to add permissions.

Then, make sure for each user that has access except for being able to delete the file:

enter image description here

This way, the file can not be deleted, if there is at least a security identifier attached.

Looking at what Microsoft has to say about the hibernation file.

When a user subsequently turns on the computer, a normal boot process occurs, except that Bootmgr checks for and detects a valid memory image stored in the hibernation file. If the hibernation file contains saved system state, Bootmgr launches Winresume, which reads the contents of the file into memory, and then resumes execution at the point in memory that is recorded in the hibernation file.

If Windows enabled the BCD setting to inform Bootmgr of a hibernation resume, this shortcuts the boot process by launching Winresume.exe, which will read the contents of the file into memory and transfer control to code in the kernel that resumes a hibernated system. That code is responsible for restarting drivers that were active when the system was shut down. Hiberfil.sys will be valid only if the last time the computer was shut down it was hibernated.

After Bootmgr enables protected mode, it is fully operational. However, it still relies on functions supplied by BIOS to access IDE-based system and boot disks as well as the display. Bootmgr’s BIOS-interfacing functions briefly switch the processor back to a mode in which services provided by the BIOS can be executed, called real mode. Bootmgr next reads the BCD file from the \Boot directory using built-in file system code.

Bootmgr contains read-only NTFS code (Bootmgr also supports other file systems, such as FAT, El Torito CDFS, UDFS, and WIM files); unlike the boot sector’s code, however, Bootmgr’s file system code can read subdirectories.

— Windows Internals

So, no, as it uses built-in file system code, doing this in a simple way is most likely impossible.

The best you could try is to change the BCD:

HKEY_LOCAL_MACHINE\BCD00000000\Objects\{db7f3566-bd6f-11df-b716-db3964014abb}\Elements\22000002\Element

Perhaps you could try modifying it to X:\Some\Path\To\Whatever\File.Ext or a fully qualified path.

A solution that will sure work which makes your question possible.

  1. Install your Windows to your HDD.

  2. Move everything to your SSD except for the hiberfil.sys file.

  3. Create junction points to everything on your SSD.

You are also able to scale down the size of the hibernation file.

You can do this towards 50% using powercfg.exe

-HIBERNATE, -H
        Enables-Disables the hibernate feature.  Hibernate timeout is not
        supported on all systems.

        Usage: POWERCFG -H <ON|OFF>
               POWERCFG -H -Size <PercentSize>
        -Size  Specifies the desired hiberfile size in percentage of the
               total memory. The default size cannot be smaller than 50.
               This switch will also enable the hiberfile automatically.
9
  • I was not able to set permissions on hiberfil.sys file. The Security tab of Properties of hiberfil.sys file says "The requested security information is either unavailable or can't be displayed".
    – user68795
    Apr 6, 2011 at 19:05
  • @caveman: Take ownership of the file first. :) Apr 6, 2011 at 19:12
  • @caveman: Updated the end of my question with a handy tip... Apr 6, 2011 at 19:21
  • 2
    What happens when you reduce the percentage?
    – Ivo Flipse
    Apr 20, 2011 at 7:48
  • 1
    @IvoFlipse: If you have 4 GB memory, and you are using less than 2 GB (excluding ReadyBoost) it would only store 2 GB if you change this towards 50% instead of 4 GB filled with zeroes or random data. Apr 20, 2011 at 9:45

You must log in to answer this question.