How Windows XP Hibernation Saved Memory to Disk

Hibernation in Windows XP was an Advanced Configuration and Power Interface (ACPI) S4 state feature that allowed users to completely power off their computers without losing their active workspaces. Instead of maintaining low power to the RAM as seen in standard Standby mode, Windows XP captured the entire physical memory contents, compressed the data, and wrote it sequentially to a designated system file called hiberfil.sys. When the system was rebooted, the bootloader read this file back into memory, seamlessly restoring the operating system, running applications, and open documents to their exact pre-shutdown states.

The Role of hiberfil.sys

The entire hibernation mechanism relied on hiberfil.sys, a hidden, contiguous system file located in the root directory of the primary boot partition (typically C:\hiberfil.sys). Under Windows XP, the operating system pre-allocated this file with a file size exactly equal to the total amount of installed physical RAM. By reserving contiguous disk clusters in advance, the operating system ensured that there would always be enough disk space to write the contents of the RAM, regardless of how fragmented the file system might be at the time of shutdown.

The Hibernation Transition Sequence

When a user initiated hibernation—either via power management settings or by holding the Shift key on the standard "Turn Off Computer" prompt to toggle "Standby" to "Hibernate"—Windows XP executed a coordinated sequence:

  1. Broadcasting Power State Requests: The Power Manager broadcast an I/O Request Packet (IRP) specifying the transition to the ACPI S4 sleep state. Device drivers and applications were notified to cease active I/O operations, save volatile state data, and prepare for immediate power loss.
  2. Suspending Threads and Services: The operating system suspended all user and background threads to prevent memory modifications while the memory contents were being prepared for disk transfer.
  3. Memory Mapping and Compression: The kernel generated a page-table map of active physical memory. To maximize write speeds and minimize disk wear, Windows XP used a lightweight compression algorithm (a variant of the LZ compression family) to compress the pages before writing them to the disk.
  4. Bypassing the File System Stack: Rather than using the standard, complex file system and storage driver stacks—which could result in race conditions or memory allocation conflicts while memory was frozen—Windows XP switched to a specialized, stripped-down disk miniport driver. This minimal driver wrote the compressed memory pages and CPU register states directly into the pre-allocated disk sectors designated for hiberfil.sys.
  5. Marking the Signature and Power Down: After writing the data, the system wrote a specific hibernation header and boot signature to the file, confirming the image was valid. Once the write operation completed, the operating system issued an ACPI command to the motherboard firmware, switching the power supply off entirely.

The Resumption Process via NTLDR

When the computer was powered back on, the boot process differed from a normal cold boot:

  1. The BIOS initialized basic hardware and passed control to NTLDR (NT Loader), the default bootloader in Windows XP.
  2. NTLDR checked the root directory of the boot drive for hiberfil.sys and inspected its header for an active hibernation signature.
  3. If a valid signature was detected, NTLDR bypassed the standard ntoskrnl.exe initialization routine and presented the graphical "Resuming Windows" progress bar.
  4. The bootloader read the compressed data from hiberfil.sys, decompressed the pages, and mapped them back into their original physical RAM addresses.
  5. Once memory was fully restored, NTLDR transferred execution back to the Windows kernel. The kernel re-initialized device drivers with power-up IRPs, restored the CPU registers, and resumed thread execution, bringing the user back to the Windows desktop instantaneously.