Sysinternals Homepage
Forum Home Forum Home > Windows Discussions > Internals
  New Posts New Posts RSS Feed - Change location of "hiberfil.sys"
  FAQ FAQ  Forum Search   Events   Register Register  Login Login

Change location of "hiberfil.sys"

 Post Reply Post Reply
Author
Message
kopierkatze View Drop Down
Newbie
Newbie


Joined: 21 July 2011
Status: Offline
Points: 1
Post Options Post Options   Thanks (0) Thanks(0)   Quote kopierkatze Quote  Post ReplyReply Direct Link To This Post Topic: Change location of "hiberfil.sys"
    Posted: 21 July 2011 at 11:18pm
Summary: I want to change the location of "hiberfil.sys" on Windows 7 (x64 and x86).


As you all probably know, you can put the Windows system files and the bootloader on different partitions. Microsoft chose the following naming scheme for these partitions (see [1]):

  • "System Partition": This is the partition on which the boot loader resides (MBR, BOOTMGR, BCD stuff, etc.). This partition does NOT contain the Windows system directory.
  • "Boot Partition": This is the partition with the Windows-directory. This partition does NOT contain the boot loader.

Very strange naming convention, I would have named them just the other way around, but whatever.


The hibernation-file "hiberfil.sys" is always stored on the partition with the windows folder ("boot partition").
This is what I want to change.


Why would I want to change that?
When you use a SSD, storage is expensive. E.g. you have a 120 GB SSD drive, and you have to waste 8 GB or 16 GB for "hiberfil.sys", for a typical RAM-size of a modern PC.
Plus: You should avoid any unnecessary writing to the SSD, as this will stress the drive. (If you have 16 GB RAM and hibernate twice a day, that means 32 GB will be written!).

It would be much better to place the bootloader partion ("System Partition") onto a classic harddrive, and store the hiberfil.sys file there. You can easily place the bootloader onto a partition on another harddrive, but there's no option to change the location of "hiberfil.sys".


Microsoft offers an "explanation" (or should I say: a lame excuse) why this is the case:
http://technet.microsoft.com/en-us/magazine/2007.11.windowsconfidential.aspx

OK, so there is a very simple file system driver in the early boot process, but anyway: This driver has to be able to read files from both, the "System Partition" and the "Boot Partition", so it really shouldn't matter, whether the hibernation data is stored in "C:\hiberfil.sys" or "D:\hiberfil.sys" (when "C:" and "D:" are the "Boot Partition" and the "System Partition", respectively).



The BCD configuration ("bcdedit.exe /enum all") suggests, that it is indeed possible to load "hiberfil.sys" from a different partition:


Wiederaufnahme aus dem Ruhezustand
----------------------------------
Bezeichner              {50b3eff0-aa69-11e0-9994-c055d5933a31}
device                  partition=C:
path                    \Windows\system32\winresume.exe
description             Windows Resume Application
locale                  de-de
inherit                 {resumeloadersettings}
filedevice              partition=C:
filepath                \hiberfil.sys
debugoptionenabled      No




You can change that, if you set the system to hibernate, and instead of resuming it on reboot, you boot into ERD Commander (from MSDaRT).

bcdedit.exe /store D:\Boot\BCD /set {50b3eff0-aa69-11e0-9994-c055d5933a31} filedevice partition=D:

I tried that, and I also manually moved "hiberfil.sys" to the other partition (restoring it's original permissions after moving).

Unfortunately, Windows didn't resume afterwards (error message: "Windows did not shut down successfully" on bootup).



I tried to analyze "winresume.exe" (from the checked build of Win7 x86) in IDA, and I found a function "HbResumeFromHibernate()" which calls:
HbInitializeDisplay(&v33);
HbOpenHiberFile();
HbpCheckPageFileValidity(&v27);
HbCheckForUserIntervention((int)&v31, 1, (int)&v30);
HbQueryInitialUserPreference();
HbSetFileDisposition(0);
HbpRestoreImageFromHiberFile(v4, a1, v33, (int)&v27);

(and many more)

I guess somewhere around there lies the problem.



So my questions are:
  1. Which part of the operating system creates the "hiberfil.sys" file?
  2. How to patch "winresume.exe" so that it resumes from the other partition?


There are many talented people out here. I guess some of you (Mark Russinovich...) know Windows even better, than the original Microsoft developers... ;-)




Further reading:

[1] http://en.wikipedia.org/wiki/System_partition_and_boot_partition
Back to Top
tacshell View Drop Down
Newbie
Newbie
Avatar

Joined: 26 June 2012
Status: Offline
Points: 1
Post Options Post Options   Thanks (0) Thanks(0)   Quote tacshell Quote  Post ReplyReply Direct Link To This Post Posted: 26 June 2012 at 10:29pm
This post is both well researched and relevant.

I recently upgraded to a 120GB SSD my self and would very interested to learn of a method of moving the hiberfil. I am disappointed that even after a year this post has not had a single reply.

If you are still working on this kopierkatze I would be willing to help, if I can.
Back to Top
MagicAndre1981 View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 08 January 2007
Location: Germany
Status: Offline
Points: 2109
Post Options Post Options   Thanks (0) Thanks(0)   Quote MagicAndre1981 Quote  Post ReplyReply Direct Link To This Post Posted: 28 June 2012 at 7:21am
In Windows 7 you can reduce the size if it is too large.
Back to Top
Mutant_Guy View Drop Down
Newbie
Newbie


Joined: 15 August 2012
Location: Srilanka
Status: Offline
Points: 1
Post Options Post Options   Thanks (0) Thanks(0)   Quote Mutant_Guy Quote  Post ReplyReply Direct Link To This Post Posted: 15 August 2012 at 11:07am
I also want do this but hence no option still :(

I know ssd start faster so hibernation might be not needed.
But i work in lot of projects and i want to keep them open when resume even after a week. So i want this hiberfil go to my secondary mechanical drive.


Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down