I need to get time when hiberfil.sys was last modified to be able to distinguish if PC was woken up from hibernation or sleep mode, but my every attempt to open that file results in error 32: Sharing violation. I know that it's possible to get it's time modified stamp, since both Explorer and my other file browser return it OK. Does anyone know how to do it?
PS. I tried GetFileAttributesEx() and CreateFile(name, FILE_READ_EA, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL) and both failed.
I spent some time with CreateFile yesterday but didn't solve it.
I did try this in C# using the FileInfo class and it worked fine.
I loaded up the system.dll in Reflector to see if I can determine the underlying FileInfo implementation, but it's a bit complicated for the cursory look I gave. With more time, one should be able to track down the api's and necessary permissions by looking at the .net implementation.
P.S. I didn't have hyperfil.sys so I used pagefile.sys.
In C#, it's one line of code.
Last edited by Arjay; August 24th, 2009 at 09:37 PM.
How come no one remembers stat()? I must be too old.
struct _stat buffer;
ctime_s(timebuf, 26, &buffer.st_mtime);
The stat() should work as well, but that is just a runtime library wrapper that uses FindFirstFile()/ FindNextFile() internally.
Originally Posted by Arjay
That's not entirely true - the C# approach works.
It probably does the same on the inside of one of the NET libraries.
From personal experience FindFirstFile()/FindNextFile() are the only APIs that can retrieve information for files that cannot be opened by any other means -- they are like "APIs of last resort" in a sense. And I don't think that there's any lower level API that can be accessed from a user (non-driver) environment, is there?