That's why I said Macrium Reflect probably doesn't even backup (the sectors containing) the hiberfil.sys file, because there's just no
point. I/we could try to chase this down in the Macrium knowledge base
etc. or/and check the contect of an image I/we made, but I won't try
such an exercise in futility.
Frank Slootweg wrote on 3/12/2026 8:26 AM:
ÿÿ That's why I said Macrium Reflect probably doesn't even backup (the
sectors containing) the hiberfil.sys file, because there's just no
point. I/we could try to chase this down in the Macrium knowledge base
etc. or/and check the contect of an image I/we made, but I won't try
such an exercise in futility.
cf.
<https://knowledgebase.macrium.com/display/KNOWX/Backup+Defaults>
Intelligent Sector Copyÿÿÿ
Only backup data blocks that are being used by files on the disk. This significantly reduces the time it takes for backups to complete and reduces the size of the backup files.
***The data blocks in Pagefile (pagefile.sys) and hibernation (hiberfil.sys) files will be excluded from images.***
Data blocks in these files are temporary and not required when Windows starts.ÿ These files will be visible in the imaged file system, but will take up zero space in the image file.
Paul wrote on 3/11/2026 1:11 PM:
On Wed, 3/11/2026 2:08 PM, ...w¤?ñ?¤ wrote:
Some of the articles are missing the point and spreading fear beyond what will/does happen.
The fear is justified, given how stupid some of the motherboard
engineering can be. One company lost the curation chain for their
BIOS releases. In some cases, the only reason this stuff works,
is because the BIOS in an Award, AMI, Phoenix, InSyde and those
companies push out the code for that.
They lost the curation chain b/c of Secure Boot requirements?
On Fri, 3/13/2026 3:18 AM, ...w¤?ñ?¤ wrote:
Frank Slootweg wrote on 3/12/2026 8:26 AM:
ÿÿ That's why I said Macrium Reflect probably doesn't even backup (the
sectors containing) the hiberfil.sys file, because there's just no
point. I/we could try to chase this down in the Macrium knowledge base
etc. or/and check the contect of an image I/we made, but I won't try
such an exercise in futility.
cf.
<https://knowledgebase.macrium.com/display/KNOWX/Backup+Defaults>
Intelligent Sector Copyÿÿÿ
Only backup data blocks that are being used by files on the disk. This significantly reduces the time it takes for backups to complete and reduces the size of the backup files.
***The data blocks in Pagefile (pagefile.sys) and hibernation (hiberfil.sys) files will be excluded from images.***
Data blocks in these files are temporary and not required when Windows starts.ÿ These files will be visible in the imaged file system, but will take up zero space in the image file.
I just tested this. I had a lot of trouble with the test subject, just getting hiberfil.sys turned on. There really is a minimum size it is happy with!
Who knew. I had to move partitions around on the test disk, it took a while to get set up for this.
The Online backup was 46,716,473 KB and the Hiberfil.sys (after having just used it to hibernate the session then wake up again) was all zeros. While it reads out as zeros, the zeros don't seem to be recorded as such. The same is true of the pagefile.sys, it's zeros and they might or might not be stored.
The Offline backup was 81,806,033 KB and the Hiberfil.sys is recorded.
The first four characters are "WAKE". The pagefile.sys is similar recorded. #HSTR:Trojan:MSIL/AgentTesla <=== a piece of some virus definitions, incoming.
Restoring an all-zeros pagefile.sys does not hurt anything. That is
because there is a GPEdit security policy that does exactly that.
It zeros the pagefile.sys at shutdown, so you "can't find those virus definitions" sitting there.
https://www.ninjaone.com/blog/virtual-memory-pagefile-encryption/
"To securely erase sensitive virtual memory data,
enable ClearPageFileAtShutdown via Group Policy...
This protects data remnants and enhances system security compliance."
The hiberfile has one header pattern for a valid head. And something different when it is invalidating the hiberfile content to prevent
accidental reuse (which might not align with file system state). so
while I can see the word "WAKE", I don't know which byte is the invalidate byte.
On Fri, 3/13/2026 4:46 AM, Paul wrote:
On Fri, 3/13/2026 3:18 AM, ...w¤?ñ?¤ wrote:
Frank Slootweg wrote on 3/12/2026 8:26 AM:
ÿÿ That's why I said Macrium Reflect probably doesn't even backup (the >>>> sectors containing) the hiberfil.sys file, because there's just no
point. I/we could try to chase this down in the Macrium knowledge base >>>> etc. or/and check the contect of an image I/we made, but I won't try
such an exercise in futility.
cf.
<https://knowledgebase.macrium.com/display/KNOWX/Backup+Defaults>
Intelligent Sector Copy
Only backup data blocks that are being used by files on the disk. This significantly reduces the time it takes for backups to complete and reduces the size of the backup files.
***The data blocks in Pagefile (pagefile.sys) and hibernation (hiberfil.sys) files will be excluded from images.***
Data blocks in these files are temporary and not required when Windows starts.ÿ These files will be visible in the imaged file system, but will take up zero space in the image file.
I just tested this. I had a lot of trouble with the test subject, just
getting hiberfil.sys turned on. There really is a minimum size it is happy with!
Who knew. I had to move partitions around on the test disk, it took a while >> to get set up for this.
Paul
On Fri, 3/13/2026 3:09 AM, ...w¤?ñ?¤ wrote:
Paul wrote on 3/11/2026 1:11 PM:
On Wed, 3/11/2026 2:08 PM, ...w¤?ñ?¤ wrote:
Some of the articles are missing the point and spreading fear beyond what will/does happen.
The fear is justified, given how stupid some of the motherboard
engineering can be. One company lost the curation chain for their
BIOS releases. In some cases, the only reason this stuff works,
is because the BIOS in an Award, AMI, Phoenix, InSyde and those
companies push out the code for that.
They lost the curation chain b/c of Secure Boot requirements?
The custody chain for BIOS updates is broken, and that injures
their ability to help customers have the best most secure
motherboards possible.
I don't use hibernation, routinely disabled(or verified as disabled) shortly after a Windows install of any type(clean, on-top, repair, feature update[now only H2]...except for testing(like you are doing).
I recall from an earlier on-MSFT-campus discussion that hiberfil.sys that was intended(oobe) to have a minimum size, but as expected that's just a starting point and growth can occur even with the same identical footprint of programs, apps, services, etc. running and without any changes to Windows.
It's like a monster *It's alive* (Victor Frankenstein, after turning on/off the electricity or lightning strike - movie version; Shelley's version - no electricity or lightning) and for my use not needed.
I saw another behavior in there I couldn't believe,
but we'll save that for another time. Something
changed the hiberfil.sys size, from one OS boot
(not hibernated) to another OS boot (not hibernated).
I've not heard of that being a capability the OS
reserves for itself. There were no conditions that
would even remotely stress the hibernation scheme
(shouldn't have taken more than a gigabyte of storage
space while hibernating, no excuse for finding my
backup was backing up a 64GB hiberfil.sys). This increased
the size of the offline backup I was making (impact would
have been greatly reduced if I had switched on compression.
Paul <nospam@needed.invalid> wrote:
[...]
I saw another behavior in there I couldn't believe,
but we'll save that for another time. Something
changed the hiberfil.sys size, from one OS boot
(not hibernated) to another OS boot (not hibernated).
I've not heard of that being a capability the OS
reserves for itself. There were no conditions that
would even remotely stress the hibernation scheme
(shouldn't have taken more than a gigabyte of storage
space while hibernating, no excuse for finding my
backup was backing up a 64GB hiberfil.sys). This increased
the size of the offline backup I was making (impact would
have been greatly reduced if I had switched on compression.
Your findings seem to be an argument for NOT making offline (Macrium Reflect) image backups, because, as mentioned/documented before, an
online image backup does NOT backup the hiberfil.sys file.
On Sun, 3/15/2026 9:31 AM, Frank Slootweg wrote:
Paul <nospam@needed.invalid> wrote:
[...]
I saw another behavior in there I couldn't believe,
but we'll save that for another time. Something
changed the hiberfil.sys size, from one OS boot
(not hibernated) to another OS boot (not hibernated).
I've not heard of that being a capability the OS
reserves for itself. There were no conditions that
would even remotely stress the hibernation scheme
(shouldn't have taken more than a gigabyte of storage
space while hibernating, no excuse for finding my
backup was backing up a 64GB hiberfil.sys). This increased
the size of the offline backup I was making (impact would
have been greatly reduced if I had switched on compression.
Your findings seem to be an argument for NOT making offline (Macrium Reflect) image backups, because, as mentioned/documented before, an
online image backup does NOT backup the hiberfil.sys file.
Good point.
A better way to run a computer, is like a lot of us are
already doing (on *desktops* at least).
powercfg /h off
Now your backups are in no danger whatsoever :-)
You cannot do that on a laptop, due to battery management issues.
(Laptop resorts to hibernation, when sleep operation depletes
the battery sufficiently to cause alarm.)
My test of Macrium, was done on 7.2 or so. While on a lot of
softwares, it could be argued a newer version would "fix"
the lack of detection of a potential issue, that's not a
pattern I note in Macrium. If they're letting something slip
like that, that is design intent and not a bug.
That's why I would prefer to see a competing product flag this.
Just so we know someone cares about the topic.
*******
A percentage of users, will be attracted to online backup, as
the provided scheduler will manage their incremental or
incremental-forever pattern. I'm not sure the offline tool
is clever enough to find the backup pattern definition file,
but it might...
| Sysop: | Jacob Catayoc |
|---|---|
| Location: | Pasay City, Metro Manila, Philippines |
| Users: | 5 |
| Nodes: | 4 (0 / 4) |
| Uptime: | 493843:26:51 |
| Calls: | 146 |
| Files: | 547 |
| D/L today: |
6 files (97K bytes) |
| Messages: | 76,635 |