Hibernating-test

[Guest]

Is possible test, whether system is hibernated? When I open hiberfil.sys for
reading 4096 bytes, I get error - access denied.

I using XPe SP2 + RAM reg EWF.

 

[KM]

Wierd question.
If the system was hibernated the power state is OFF. If you are trying to read the hiberfil.sys file offline (from another OS load
or on another machine if you moved the hard drisk there) you should not get "access denied" errors.
If you are reading the file online (from the OS that uses the file) the system is obviously NOT hibernated.

 

[Guest]

I using HORM system: First I enable EWF and then I hibernate system. Next
starts system loads from the same hiberfil.sys and I want know whether system
is hibernated or not but I don't open hiberfil.sys for reading first 4096
bytes.

 

[KM]

Let me see if I understood your question correctly.
When you boot the OS from a HORM [hibernate] state at run time you want to know whether the system started cold boot or was resumed
from the hiberfil.sys file. Right?

You can't open the hiberfil.sys file from the same OS. The system keeps the file locked if hibernation feature is enabled.

You can try to use the existance of the resmany.dat at the root of the system volume as the indicator. The resmany.dat file is used
to notify ntldr to boot from the hibernation file. The ntldr changes the signature of the hibernation file when it is first booted
(this is probably what you were trying to check, right?).