I've noticed that if I make a registry change and then hard-shutdown my Windows 10 system, the registry change does not appear after reboot.
I've also noticed that the deletion of a hibernation file can impact the ability for a Linux recovery tool to make changes to the Windows registry in an offline state. The tool seems unable to make persistent changes after the deletion of a hibernation file. I will list specific examples below.
- I add a key called "1111" into "HKLM\SOFTWARE". I then hard power down my box by holding the power button for 5 seconds.
- When I pull the registry back up, that key and its values are gone:
- (These images were edited for formatting purposes)
- Make a change in the registry (using regedit)
- Hibernate the system
- Boot into a Linux recovery tool
- Delete the hibernation file in order to mount the disk.
- Read the windows registry (from the recovery tool)
- The registry change is gone.
This seems equivalent to a hard shutdown on the box.
I see stranger behavior when I:
- Hibernate the box
- Boot to a Linux recovery tool and delete the hibernation file
- Make changes to the registry (from the recovery tool)
- Reboot the box
Those changes are not reflected in the registry either.
So what's going on here?
- When does Windows 10 write the registry changes to the disk?
- Why does the deletion of a hibernation file (in Example 3) prevent registry changes made from the recovery tool from being reflected on the next boot?
Hoping to get some clarification!