Can't get time off of the hiberfil.sys

[ahmd]

I need to get time when hiberfil.sys was last modified to be able to distinguish if PC was woken up from hibernation or sleep mode, but my every attempt to open that file results in error 32: Sharing violation. I know that it's possible to get it's time modified stamp, since both Explorer and my other file browser return it OK. Does anyone know how to do it?

PS. I tried GetFileAttributesEx() and CreateFile(name, FILE_READ_EA, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL) and both failed.

[dc_2000]

The Explorer probably uses FindFirstFile(). Try it...

[Arjay]

I spent some time with CreateFile yesterday but didn't solve it.

I did try this in C# using the FileInfo class and it worked fine.

I loaded up the system.dll in Reflector to see if I can determine the underlying FileInfo implementation, but it's a bit complicated for the cursory look I gave. With more time, one should be able to track down the api's and necessary permissions by looking at the .net implementation.

P.S. I didn't have hyperfil.sys so I used pagefile.sys.

In C#, it's one line of code.

[Codeplug]

Try FindFirstFile.

gg

[ahmd]

Yeah, I tried the first poster's suggestion and strangely enough FindFirstFile was able to give the time stamps, etc. None of the other approaches worked. Thank you guys!

[Arjay]

Yeah, I tried the first poster's suggestion and strangely enough FindFirstFile was able to give the time stamps, etc. None of the other approaches worked. Thank you guys!

That's not entirely true - the C# approach works.

[hoxsiew]

How come no one remembers stat()? I must be too old.

  struct _stat buffer;
  char timebuf[26];

  int rc=_wstat(L"c:\\hiberfil.sys",&buffer);
  ctime_s(timebuf, 26, &buffer.st_mtime);

[dc_2000]

How come no one remembers stat()? I must be too old.

  struct _stat buffer;
  char timebuf[26];

  int rc=_wstat(L"c:\\hiberfil.sys",&buffer);
  ctime_s(timebuf, 26, &buffer.st_mtime);

The stat() should work as well, but that is just a runtime library wrapper that uses FindFirstFile()/ FindNextFile() internally.

That's not entirely true - the C# approach works.

It probably does the same on the inside of one of the NET libraries.

From personal experience FindFirstFile()/FindNextFile() are the only APIs that can retrieve information for files that cannot be opened by any other means -- they are like "APIs of last resort" in a sense. And I don't think that there's any lower level API that can be accessed from a user (non-driver) environment, is there?

[carl666]

I need to get time when hiberfil.sys was last modified to be able to distinguish if PC was woken up from hibernation or sleep mode

It won't help : hiberfil.sys is not updated when Windows hibernates...