I'm trying to restore lost data from unsaved notepad.exes after Windows 7 automatically restarts (dang Windows Update).

Browsing a couple of threads, it seems to be an impossible task. However, I have previously done hibernation just a few hours ago and there's a neat 2.89 GB memory dump at C:\hiberfil.sys. I also have a 3.35 GB C:\pagefile.sys.

How can I restore to this previous hibernation state?

Alternatively, is there a program that can view C:\hiberfil.sys (e.g. viewing through the previous state as though it's a virtual machine)?

My Current System Info:
My Current System Info

Control Panel\System and Security\Windows Update\View update history:
<code>Control Panel\System and Security\Windows Update\View update history</code>

  • 1
    Unfortunately, after a Windows update, files on your disk will no longer match things like cached directory contents in the saved hibernate file. You would have to have some way of putting the disk back to the exact state it was in when the hibernation occurred. And if you did that, the machine would just come up and restore state from that file. Your long-term answer is to use a note-taking app that automatically saves everything. – Jamie Hanrahan Nov 19 '14 at 11:25
  • @JamieHanrahan, There had got to be a way to open that file on a virtual machine or something since I know the exact bytes (version) that represents my Windows right now and before the Windows updates. – Pacerier Nov 19 '14 at 11:48
  • The hibernation file doesn't contain your data, its a placeholder file, in order to reserve the space required to hibernate your system. – Ramhound Nov 19 '14 at 11:56
  • @Ramhound, The hibernation file is simply a frost of the RAM right? And the unsaved notepads are stored in the RAM. Why is restoration not possible? – Pacerier Nov 19 '14 at 12:01
  • @Pacerier - Because the file you see isn't from your last hibernation state that was already been discarded when you did the reboot. As I said the file you see is reserving the space for the next time you hibernate – Ramhound Nov 19 '14 at 12:07

Sorry, there is no way that takes less than a week (or maybe month) to restore file like this.

  1. As far I know - hiberfil.sys is compressed and not well documented. Long time ago there was a tool to read windows 2000 hiberfil.sys, it was called SandMan. I think this will not work with Windows 6.0 and higher.

  2. Even if you manage to reproduce raw memory that was dumped into hiberfil.sys - do not expect you will find your file there. Process memory will be fragmented, so you would have to put everything together to make it "readable" like process memory dump from Task Manager. Which is not very readable too.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.