Browse hiberfil.sys

[Guest]

A friend accidentally poured a glass of Magaret River Chardonnay over our
laptop. The laptop was on and a number of files were open. The machine
stopped responding - of course! I removed the HDD which was not directly
affected and plugged it into our pc to browse for the files. One Excel file
seemed to have lost data dating back some 3 weeks, yet it was saved each day.
Our last back-up was a little older than this so no good there. I went to the
AutoRecover folder and found a file named ~ar6705.xar (138kb). Opened it with
Excel and it had the same data as the original, ie 3 weeks still missing!

It then occured to me that there may be a later version (ie the one that was
open before the flood) within the hiberfil.sys

Is it at all possible to browse this file? I have dragged the net on this
subject but to no avail. Surely there must be a way of extracting a file from
within. Heeeeeeeeeelp!!!!!!!!

 

[Pegasus \(MVP\)]

A friend accidentally poured a glass of Magaret River Chardonnay over our
laptop. The laptop was on and a number of files were open. The machine
stopped responding - of course! I removed the HDD which was not directly
affected and plugged it into our pc to browse for the files. One Excel file
seemed to have lost data dating back some 3 weeks, yet it was saved each day.
Our last back-up was a little older than this so no good there. I went to the
AutoRecover folder and found a file named ~ar6705.xar (138kb). Opened it with
Excel and it had the same data as the original, ie 3 weeks still missing!

It then occured to me that there may be a later version (ie the one that was
open before the flood) within the hiberfil.sys

Is it at all possible to browse this file? I have dragged the net on this
subject but to no avail. Surely there must be a way of extracting a file from
within. Heeeeeeeeeelp!!!!!!!!

The file "hiberfil.sys" does not contain copies of files - it contains
a copy of what was in memory at the time when the machine last
went into hibernation. To make any sense of this data you would
need to know two things:
- How the memory space in Windows was organised at the time, and
- How Excel stores in data in working memory.

While it may be possible to do this, I suspect that the effort would
cost you vastly more time than re-entering the lost information.
Your friend should consider this unfortunate event as an unpleasant
reminder that all important files must be backed up regularly. A 2.5"
disk in an external USB case is a low cost but highly effective
backup medium - what's preventing him from using one?

 

[Guest]

Thanks for your prompt reply Pegasus. I think that she was more dismayed that
she had saved the file daily to a hard-drive that has not actually crashed. A
back-up file would have returned the same results wouldn't it? Like most
people who do back-up occassionally, we never test the back-up for integrity.

The lost data was her daily takings in her small business and has been lost
altogether - she will have to interpolate and compare and put in a good guess
for the missing data!

For my part in this, I was only trying all possibilities. I only know just
enough to be dangerous! Now that you have described to me how the hiberfil
works, I now wish to take the option of finding out the structure of it. The
data may or may not be in there - I'm fairly sure there will be at least 2
weeks of data - so how do I extract it? How do I find the two things you
describe:
- How the memory space in Windows was organised at the time, and
- How Excel stores in data in working memory?
You say it may be possible. Is it really? We have no other choice. Where can
I get this info?

Thanks and kind regards
Darth

 

[Pegasus \(MVP\)]

See below.

Thanks for your prompt reply Pegasus. I think that she was more dismayed that
she had saved the file daily to a hard-drive that has not actually crashed. A
back-up file would have returned the same results wouldn't it?

If she had backed up her files to an independent medium (e.g.
an external hard disk) then she would have been safe.

Like most people who do back-up occassionally,
we never test the back-up for integrity.

I check all backups when implementing the scheme and then
at regular intervals.

The lost data was her daily takings in her small business and has been lost
altogether - she will have to interpolate and compare and put in a good guess
for the missing data!

She should get some professional help to design a solid
and reliable backup system. This can be done remotely -
no need to attend on site.

For my part in this, I was only trying all possibilities. I only know just
enough to be dangerous! Now that you have described to me how the hiberfil
works, I now wish to take the option of finding out the structure of it. The
data may or may not be in there - I'm fairly sure there will be at least 2
weeks of data - so how do I extract it? How do I find the two things you
describe:
- How the memory space in Windows was organised at the time, and
- How Excel stores in data in working memory?
You say it may be possible. Is it really? We have no other choice. Where can
I get this info?

Probably from text books that describe the inner workings of
Windows and Excel. As I said, I think this is unrealistic but
perhaps someone else would care to comment.

 

[Pegasus \(MVP\)]

Here is a method that has a remote chance of success. I shall
call it the "Substitution Racket".
1. Save the hibernation file on a different machine.
2. Turn on the laptop.
3. Put it into hibernation.
4. Remove the hard disk without switching off the laptop.
5. Replace the current hibernation file with the saved version.
6. Put the disk back into the laptop.
7. Wake up the laptop.
The laptop will probably seize up and crash. However, there
is a slight chance that it does not and that it flips back to the
condition it was in when the accident happened.

 

[Guest]

Pegasus, That looks like a terrific solution and I will try it as soon as I
get the laptop back together. I dismantled it (with some difficulty) and am
in the process of cleaning it. If it fails altogether, I will send it to the
pros to trace the faulty part. As this may take quite some time for a result,
I will email you the details. Should this actually work, I will personnally
back your claim to the name "Subsitution Racket". What a hoot! Please email
me on (e-mail address removed) so I can pick up your email. I hope by posting
mine in the middle of this clumsy paragraph, it sneaks in under the spammers'
radar. Thanks again for your clear thinking. (....damn, why didn't I think of
that one?....simply brilliant.....damn!....)

Darth

 

[Pegasus \(MVP\)]

I'm afraid I don't share your optimism. The method I suggested
will most likely crash the machine but since there is a small
chance of success it's worth a try. Feel free to send your report
to pegasus_fnlATyahooDOTcom. I monitor it about once every
week.