Does Windows 7 deleted files generated during hibernation?

Somebody was using my Windows 7 and she hibernated it instead of shutting down. Later, I booted up Ubuntu and moved about 2GB worth of files from the Ubuntu partition to the Windows partition.

After booting up Windows (from hibernation), I couldn't find any of the files. Then I restarted the PC, and the files showed for a second or two and then disappeared.

Did Windows delete all the files I put on it while it was hibernating?

Solution 1:

When Microsoft said "Do not make major changes to the computer's state after you put the computer in hibernation or on standby.", it meant it.

Changes to the computer's state include bootstrapping another operating system entirely and modifying what's on the hard disc. You've just witnessed what goes wrong when one does that: volumes become corrupt, files and directories (not at all) mysteriously look just like they did when Windows hibernated, strange errors occur. SuperUser has a whole mountain of tales of woe from people who tried this.

Hibernation is not shutdown. The cache manager and all of the installable filesystem drivers retain their in-memory state across hibernation. After all, that is the point. This state includes open files, unwritten data and metadata in memory, and so forth. During hibernation, the state of your volume(s) on disc isn't necessarily consistent, and isn't the state that it would be had the machine been actually shut down, with all of the files closed, transactions finished, and pending writes flushed.

During hibernation (of Windows, Linux, or indeed any other current operating system with this mechanism) …

• … do not mount any NTFS, FAT, or other types of disc volumes that were in use by the operating system that you hibernated, as anything other than strictly read-only from any operating system.
• … do not blithely and erroneously think that the only operations that could update the on-disc data structures for a volume are writing to files.

If you want to bootstrap another operating system, shut down.

Further reading

• Gilles (2010-11-15). "You need a reader-writer lock on each shared partition." SuperUser.