Windows – HDD with Windows boot locked because of hibernation flag

boothibernatepartitioningwindows

My Mom's PC's hard drive won't boot. So I took it out, plugged it to my PC and ran the GParted Live CD. The physical drive is found, but there are the yellow warning triangle beside the logical partition of the 2 ntfs partitions.

The "Information" tab didn't actually provide much answers, so I tried mounting both logical partitions. Here's what I got:

sudo mount /dev/sdc1/ mnt/c

Windows is hibernated, refused to mount.
The disk contains an unclean file system (0,0).
Metadata kept in Windows cache, refused to mount.
Falling back to read-only mount because the NTFS partition is in an
unsafe state. Please resume and shutdown Windows fully (no hibernation
or fast restarting.)
ntfs-3g-mount: failed to access mountpoint /mnt/c: No such file or directory

I get the same error message for both partition. Kinda very weird as, boot error flags are only applied to the designated boot drive (C:). I've set up my Mom's User folder to be in (D:), so whatever happens we can always pull out the files. Now both drives are locked out with hibernation.

My Mom needs her files. How do I safely remove the hibernation flag?

Best Answer

  • You don't say what version of Windows is involved, but if it's Windows 8 or later, what you're seeing is most likely the result of the Windows Fast Startup and/or Hibernate features. These features turn a Windows shutdown operation into a suspend-to-disk operation. The point of this is to reduce startup times, since it's faster to resume from a suspend-to-disk than it is to fully start the OS. The problem is that this leaves the filesystems in an inconsistent state, and that's what the message you see in GParted Live is telling you when you attempt to mount the partitions.

    The best solution is to boot the disk into Windows (on the original computer, using the original Windows installation) and disable these two features. Doing so is described here for Fast Startup and here for Hibernate. I realize you say that the computer has stopped booting, but it might be best to tackle that problem rather than do anything else, at least initially. (OTOH, if you've done anything to write to those partitions, then you've already eliminated the value of this approach over the next one....) You might want to ask about such repairs on a Windows-specific forum.

    If you really can't get the original computer to boot the original OS, then the next-best approach is to connect the disk to another Windows computer and use it to repair the filesystems. Note that, if that computer uses Fast Startup, you should either use a "safe eject" type feature (if one is available) or disable Fast Startup and Hibernate on it before moving the disk anywhere else. If you just shut down with Fast Startup active, you'll end up with the same inconsistent state for the disk. (I'm not a Windows expert, so I can't say how you'd "safely eject" the disk. This is fairly easy with USB flash drives, but I don't know about hard disks.)

    If you have no other Windows computer at hand, you might be able to use a Windows emergency disk for this task. I don't have pointers to these offhand, but I know they exist, floating around on the Web from reputable sources (even Microsoft, IIRC). Be sure to use something from a reputable source, though; if you download it from a site called "Sergei's Super Honest Not-a-Computer-Criminal Get Good Stuff Cheap," you may find your computer infected with malware when you're done.

    As a final last-ditch effort, you could try using the recover option when mounting the partition in Linux, as in:

    sudo mount -o recover,ro /dev/sdb2 /mnt/foo
    

    This might mount the disk. Note that in my example, I've also specified ro (read-only), to minimize the risk of this approach. With any luck, you'll at least be able to copy files off the disk. I can't guarantee that this will work, though.