Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. hiberfil.sys
FileRisk: Caution
  • Hidden

hiberfil.sys C:\hiberfil.sys

Hibernation file holding the memory image written on hibernate. It is removed when hibernation is turned off with powercfg /hibernate off.

Updated on By AltF4 Formation

What it’s for

A hidden system file located in the root of the drive where Windows is installed. The Windows Kernel Power Manager reserves it at installation time. When the computer hibernates, Windows writes the contents of RAM to this file and reloads it at the next start. Fast startup also relies on hibernation.

What it contains

  • A compressed image of memory (kernel, driver and session state) written at hibernation.
  • Size: it depends on the hibernation file type (full or reduced) and on the configured size; it can be much smaller than the installed RAM. To find it on your machine, use powercfg /h /size or read the file size.

Risks and best practices

  • To get rid of the file, turn hibernation off and Windows removes it itself. You free disk space, but hibernate and fast startup go away too.
  • On servers or virtual machines that do not need hibernation, turning it off is common.
  • The file can hold sensitive data that was in memory (keys, passwords): encrypt the disk.

Useful commands

Fenêtre de terminal
# Hibernation status and available sleep states
powercfg /a


# File size (if it exists)
Get-Item -Force C:\hiberfil.sys | Select-Object FullName, Length


# As administrator: disable hibernation (deletes hiberfil.sys)
powercfg /hibernate off


# As administrator: re-enable hibernation
powercfg /hibernate on

Report a mistake