What Is hiberfil.sys and When Deleting It Makes Sense

What hiberfil.sys actually does

When Windows hibernates, it writes the entire contents of RAM to C:hiberfil.sys and powers off; resume reads the file back and you continue exactly where you stopped, with zero power drain in between. Fast Startup uses the same mechanism in miniature: at shutdown it saves only the kernel session, so the next boot skips reinitializing drivers and services. On current Windows 11 builds the full file equals about 40% of installed RAM — 13 GB on a 32 GB machine — and a reduced variant roughly halves that. The file is owned and locked by the system because the boot loader needs it before Windows even starts; that's also why no delete dialog ever wins against it.

• Hibernation itself: the zero-power state laptops drop into when the battery is nearly dead
• Fast Startup: shutdown stops being a partial hibernate and cold boots get slower
• Hybrid sleep on desktops: the hibernation backup that protects open work from a power cut
• Resume from hibernation: obvious, but worth naming — there's nothing left to resume from

Why deleting it by hand fails — and the switch that works

Taking ownership and deleting hiberfil.sys from inside Windows doesn't work: the file is in use before you can touch it, and people who force the delete from recovery media discover that Windows recreates the file on the next boot anyway. The supported control is an elevated command prompt: powercfg /h off removes the file immediately and disables hibernation and Fast Startup, and powercfg /h on restores both. powercfg /h /type reduced is the middle ground — it shrinks the file to roughly half while keeping Fast Startup alive, at the cost of full hibernation. Try the reduced variant first if your only complaint is the size; losing real hibernation on a laptop is a worse deal than 13 GB of SSD.

When switching it off actually makes sense

On a 256 GB laptop where you never hibernate — you sleep, or you shut down properly — powercfg /h off returns real space and you'll notice nothing except a few seconds slower boot. Dual-booters have a stronger reason: Fast Startup leaves the Windows filesystem in a half-hibernated state, which Linux refuses to mount read-write and imaging tools treat as a dirty volume. If you clone disks or share NTFS partitions with another OS, disabling it is standard hygiene, not paranoia. What's never worth it: deleting pagefile.sys or swapfile.sys because you confused them with hiberfil — those serve live memory management, and killing them is a different, worse idea.

Questions and Answers

Read next