Is it possible to prevent Windows from deleting hibernate file (hiberfil.sys) when shut down?

Question

I'm trying to move the hibernate file from system partition (SSD) to some other partition (HDD).

I know a lot of people say this is impossible, but I'm not completely convinced yet.

What I'm trying to do is:

1. Boot up from Windows 7 DVD;
2. Copy hiberfil.sys from SSD to HDD;
3. Delete hiberfil.sys from SSD;
4. Create a symbolic link for hiberfil.sys on SSD;

Unfortunately, when I boot up from Windows 7 DVD, I sadly found the hiberfil.sys file was not there. I remember I have read somewhere that Windows automatically deletes the hiberfil.sys file when shut down.

Is it possible to prevent Windows from deleting hiberfil.sys file when shut down?

Thanks

---

Update:

It seems Windows actually doesn't delete hiberfil.sys file when shut down. It was the VMware Tools automatically disabled hibernate when shut down / start up.

Answer 1

No, you can't move it.

During boot time Windows (and your BIOS) uses a minimal file I/O system to locate the boot drive and files needed to finish the boot (including the file-system drivers). Since the hibernation file contains system state before shutdown, it's needed actually boot to the 'full' file system.

If you've been around since the DOS days, you may remember having to use "SYS" to make a disk bootable; you couldn't just copy the boot files (msdos.sys, io.sys, etc.) to the disk and have it work, becuase they need(ed) to be at a specific address on the disk so the system knew where to find them to boot the actual OS. Same deal here...

Here's a good blurb about it:

Hibernation follows a similar pattern. Hibernating the operating system means dumping the entire contents of memory into the hibernation file; restoring from hibernation entails sucking that file back into memory and pretending nothing happened. Again, it's another chicken-and-egg problem: to load the hibernation file, you need the file system driver, but the file system driver is in the hibernation file. If you keep the hibernation file in the root directory of the boot drive, the miniature file system driver can be used instead.

You can read the rest of the article here.

Answer 2

Disallowing deletes (if there is a SID)

First make sure that hiberfil.sys isn't inheriting permissions, be sure to add permissions.

Then, make sure for each user that has access except for being able to delete the file:

This way, the file can not be deleted, if there is at least a security identifier attached.

Looking at what Microsoft has to say about the hibernation file.

When a user subsequently turns on the computer, a normal boot process occurs, except that Bootmgr checks for and detects a valid memory image stored in the hibernation file. If the hibernation file contains saved system state, Bootmgr launches Winresume, which reads the contents of the file into memory, and then resumes execution at the point in memory that is recorded in the hibernation file.

If Windows enabled the BCD setting to inform Bootmgr of a hibernation resume, this shortcuts the boot process by launching Winresume.exe, which will read the contents of the file into memory and transfer control to code in the kernel that resumes a hibernated system. That code is responsible for restarting drivers that were active when the system was shut down. Hiberfil.sys will be valid only if the last time the computer was shut down it was hibernated.

After Bootmgr enables protected mode, it is fully operational. However, it still relies on functions supplied by BIOS to access IDE-based system and boot disks as well as the display. Bootmgr’s BIOS-interfacing functions briefly switch the processor back to a mode in which services provided by the BIOS can be executed, called real mode. Bootmgr next reads the BCD file from the \Boot directory using built-in file system code.

Bootmgr contains read-only NTFS code (Bootmgr also supports other file systems, such as FAT, El Torito CDFS, UDFS, and WIM files); unlike the boot sector’s code, however, Bootmgr’s file system code can read subdirectories.

— Windows Internals

So, no, as it uses built-in file system code, doing this in a simple way is most likely impossible.

The best you could try is to change the BCD:

HKEY_LOCAL_MACHINE\BCD00000000\Objects\{db7f3566-bd6f-11df-b716-db3964014abb}\Elements\22000002\Element

Perhaps you could try modifying it to X:\Some\Path\To\Whatever\File.Ext or a fully qualified path.

A solution that will sure work which makes your question possible.

1. Install your Windows to your HDD.

2. Move everything to your SSD except for the hiberfil.sys file.

3. Create junction points to everything on your SSD.

You are also able to scale down the size of the hibernation file.

You can do this towards 50% using powercfg.exe

-HIBERNATE, -H
        Enables-Disables the hibernate feature.  Hibernate timeout is not
        supported on all systems.

        Usage: POWERCFG -H <ON|OFF>
               POWERCFG -H -Size <PercentSize>
        -Size  Specifies the desired hiberfile size in percentage of the
               total memory. The default size cannot be smaller than 50.
               This switch will also enable the hiberfile automatically.