locked
FBWF and Hibernate /w exclusion does not appear to resume RRS feed

  • Question

  • I have a WES7 image that has FBWF protecting the c: drive and not the d: drive.

    I have added /hiberfil.sys to the exclusion list.

    When I hibernate, either through Start->hibernate or "shutdown /h" then start the system back up, it always appears to start up new. I try to test this but opening some folder or file, then going to hibernate and seeing if it appears on startup. I also watch startup time, seems to be about the same as a cold boot.

    When I look at the hiberfil.sys it does correctly have a modified date time stamp of the shutdown time, so it is getting written to. But, it does not appear to resume from it.

    The reason I am looking into this is because I will have a protected c: and non-protected d:. If I go with EWF /w HORM (this does appear to start back up in the hibernated state, and quicker than cold boot) then I would have to mount/dismount on startup/hibernate.

    Is there anything I may be missing or maybe look at to help debug the situation?

    Thanks,

    Mike


    • Edited by MikeA86 Thursday, June 6, 2013 5:57 PM spellcheck
    Thursday, June 6, 2013 4:17 PM

All replies

  • You might be running into a cache limit with FBWF. The hibersys file size is the same size as the amount of RAM in the system. If this is above 1GB, the hibersys file is probably not getting created.

    www.annabooks.com / www.seanliming.com / Book Author - Pro Guide to WE8S, Pro Guide to WES 7, Pro Guide to POS for .NET

    Monday, June 10, 2013 5:04 PM
  • I am a bit confused, since hiberfil.sys is in my exclusion, it should just write to it, no matter the size right?

    I think that I see the hiberfil.sys getting updated (at least I see the modified date being changed). Its just that WES7 is not resuming from it. Are you saying that FBWF might be blocking something on the resume?

    Thanks,

    Mike

    Wednesday, June 12, 2013 4:06 PM
  • FBWF has a limitation on file I/O operations since every transaction is being cached. There are some old posts on this and I just ran into a customer who had an application that ran into this limitation.

    If you disable FBWF and compare cold boot to hibernate resume - which one is faster and by how much?


    www.annabooks.com / www.seanliming.com / Book Author - Pro Guide to WE8S, Pro Guide to WES 7, Pro Guide to POS for .NET

    Wednesday, June 12, 2013 9:19 PM
  • Sorry, I must not be quite understanding yet.

    I tried finding posts related to this FBWF, I did not find any (admittidly I lonly look at the first few handful of results of FBWF), are they much older than that?

    In your book I was under the impression that a write to a file that was in the exclusion list goes straight to the file on the hard drive, it skips the overlay all together.

    I have tried a cold boot vs hibernate, and while I have not stopwatched it, it does start up noticeably faster by a few seconds. This speedup is most seen after the login. I have seen this with both FBWF disable and hibernated, as well as EWF /w HORM.

    Thanks again for all the help,

    Mike

    Monday, June 17, 2013 11:27 AM
  • Someone posted that you don't have to add the hibersys file to the write-through

    http://social.msdn.microsoft.com/Forums/en-US/quebeceefs/thread/8b7626fd-9061-4d0d-813d-5ae83cdd428f/

    Not sure what to tell you.


    www.annabooks.com / www.seanliming.com / Book Author - Pro Guide to WE8S, Pro Guide to WES 7, Pro Guide to POS for .NET

    Monday, June 17, 2013 5:51 PM