Like This Blog 2

Added by Steve Fullmer October 19, 2012

With the advent of advanced power settings in Windows 7, the Windows hibernation file (hiberfil.sys) is more commonly present on the hard drives of both mobile and desktop devices. Whether you are protecting yourself from loss of battery power, accidental contact with the power switch, or a power blackout, hibernation mode is designed to save your work. I actually find the use of hibernation mode to be extremely useful on my desktop. All my active work is saved, and should we lose power during monsoon season, recovery and return to work is very fast and efficient. If you have sufficient drive space, and a processor capable of supporting Windows 7, you should not see a noticeable performance hit.

The hibernation file, when present, requires disk space equivalent to the size of installed RAM.  On a system with 4 GB installed RAM, the hibernation file would use 4GB of storage space at the root of the boot drive. In Windows 7, Microsoft provides options for relocating the virtual memory file (pagefile.sys), to an alternate hard drive or to a solid state drive using ReadyBoost™. Not so the hibernation file. As a component of the boot sequence, the hibernation file must remain at the root of the boot drive if it is present.

I discuss drive space planning in a separate blog. Windows 7 Disk Usage Planning – Guidelines for better storage requirements. This entry discusses hiberfil.sys in more detail, and highlights a few approaches to the resolution of common issues. If you are going to use hibernation mode with Windows 7, you need to know how to recover disk space once you disable the setting, and to recover from some of the boot problems that might arise.

If you enable either hibernation mode or hybrid sleep mode, hiberfil.sys will be created automatically by the system. Hibernation mode power settings results in regular updates to hiberfil.sys so that it represents the memory state when power is lost. Hybrid sleep mode diminishes power to the system components identified in power settings, and effectively does not update hiberfil.sys until the battery power diminishes below a configurable threshold. In either case, hiberfil.sys will be created on the system drive as soon as the power setting is enabled. Using the control panel interface to disable hibernation mode does not result in deletion of hiberfil.sys. Therefore, once you have enabled hibernation mode through the control panel, you have dedicated the space whether hibernation mode is further enabled or not. Turning on hibernation mode also creates registry and boot settings. Hiberfil.sys is a hidden system file, requiring you to unhide and unprotect it before manual deletion, although this will not affect any registry or boot settings.

So, how should you remove the file if you want to recover space after disabling hibernation mode? Use the command line tool instead of the control panel interface. The powercfg command line tool automatically deletes the hibernation file when the setting is disabled, as well as properly configuring registry and boot settings. In fact, use of the command line tool to remove the hibernation file is recommended in several boot recovery scenarios.

To enable or disable hibernation mode from the command line, use to following command sequences. Note that it is essential to run the command prompt as an administrator or the changes will not occur as desired.

1. Click Start, and then type cmd in the Start Search box.
2. In the search results list, right-click Command Prompt, and then click Run as Administrator.
3. If you are prompted by User Account Control, click Continue.
4. At the command prompt, use powercfg.exe to change hibernation settings

a) You may use powercfg.exe or powercfg, either is interpreted correctly.
b) Hibernation mode is affected with the /hibernation, /h, or –h switches. Each form of switch is recognized.
c) To turn hibernation mode on, add on.  To turn hibernation off, use off.
d) An example to enable hibernation mode is powercfg /hibernation on
e) An example to disable hibernation mode is powercfg.exe –h off

5. To confirm successfully enabling hibernation mode, you can type attrib h*.*  at the root of the boot drive to look for the instance of hiberfil.sys. To confirm that hibernation mode is disabled, once again use attrib h*.*  at the root of the boot drive (e.g. C:\) and you should not see an instance of hiberfil.sys.

6. Type exit and then press ENTER to close the Command Prompt window.

Remember, disabling hibernation mode via control panel power settings does not remove the hibernation file, it merely disables the setting. If you want to recover the disk space, then you must use the command line tool.

Hiberfil.sys, if present, is a part of the Windows 7 boot sequence. A good overview of the boot files sequence is available Windows 7, vista boot sequence, startup process, how they boot? If  hibernation mode is set, in addition to the creation of the hibernation file, a change is made to the boot control database. Rather than calling winload.exe to load the operating system, winresume.exe is called and loads hiberfil.sys directly to memory.

The following is a screenshot of a boot control database.

A detailed look at the boot control database would reveal an entry for resume from hibernate that matched the GUID of the resumeobject from the above control database. It might look like:

If hiberfil.sys is present, then winresume.exe is invoked rather than winload.exe.

If the hibernation file is present, but corrupted, the system may hang during the boot process. Correction alternatives require using the F8 key to enter the recovery environment for Windows 7 or booting from alternate media. Once into a command line interface, hiberfil.sys needs to be removed from the root of the boot drive so that winload.exe is invoked. In this instance, it may be necessary to manually remove hiberfil.sys, but try powercfg first.

Alternately, the boot control database may be attempting to use winresume.exe although there is no hibernation file. Once in the recovery environment, the boot control database will need to be repaired using BCDEdit. Technet provides instructions for editing the Boot control database using BCDEdit. Note particularly the community content at the end of the Technet article that walks through the emergency process of repairing the boot control database if it is damaged.

How do you know if you have a missing or corrupted hibernation file? The Windows boot error status 0xc00000e9 indicates that BIOS or EFI is unable to properly communicate with the hard drive to find a necessary boot process file. This might occur due to missing or damaged boot control database, winload.exe, winresume.exe, or hiberfil.sys (and other boot process files). The message will typically state which file is missing or corrupt.  The earlier in the boot sequence that the error occurs, the more likely the problem is associated with BIOS or a driver. The later in the boot process, the more likely to problem is to be with missing or corrupted boot files, including hiberfil.sys. Should you receive this error message, you will want to first try a standard Windows 7 boot recovery process, including removal of the hibernation file using the powercfg.exe -h off option. This will better assure a standard winload.exe process. You can always reset hibernation mode once you know the system will boot through the standard process.

Although I focused on clearing or correcting hibernation file issues, I have been able to use hibernation mode without any problems for the past two years. Plan for the use of available drive space. Maintain disk integrity and performance using tools like disk cleanup, chkdsk and disk defragmenter. Turn off hibernation mode before making any system hardware changes, like adding or replacing RAM, to limit the variables associated with possible troubleshooting efforts. These proactive efforts should help you to avoid hibernation file issues. 

Enjoy the enhanced protection that hibernation mode affords
Steven Fullmer
Interface Technical Training Windows 7 Instructor and PMP