Difference between revisions of "Linux Mount Hibernated Windows Partitions"

Revision as of 16:23, 15 March 2021

This article applies to:

• NTFS Partition is in an Unsafe State
• The NTFS partition is in an unsafe state. Please resume and shutdown Windows fully (no hibernation or fast restarting)
• unclean shutdowned Windows NTFS or FAT32
• Windows is hibernated, Hibernation mode, hiberfil.sys
• Windows Fast Startup Feature

Mounting an NTFS partition on your Linux system with read-write access is both possible and somewhat commonly done. However there are a number of factors that can increase the complication of attempting to do this, and mounting in the most simple fashion will fail. One situation is when attempting to use Linux for data recovery from a NTFS formatted drive on a system that has failed for one reason or another. If the system failed when Windows what not shut down in the normal way, but rather placed in hybrid sleep aka suspended mode, mounting and accessing the data from Linux off of that drive can be problematic. Fortunately, there is still a relatively direct path to accessing the data in a read-only way, which is perfect for data recovery, even if the drive is in early stage failure.

An excerpt from an online source:

Explanation: Why Linux can't open hibernated Windows partitions:

You are seeing this error because you hibernated Windows instead of turning it off the normal way (in newer versions of Windows, hibernate might be the default option).

• Hibernating saves the current state information to the hard disk and then powers down the computer.
• Shutting down the computer closes all programs and ends all running processes before powering down the computer.

When you turn off Windows by hibernating it, you are essentially pausing the system and saving all of that information (into a big file called hiberfil.sys) This way when you resume from hibernation all of your applications and files will be exactly how you left them. It also sets a flag in hiberfil.sys to let other Operating Systems know that Windows is hibernated.

Making changes to your Windows (ntfs) partition while it is hibernated could be dangerous--it could cause Windows to not resume from hibernation or to crash after resuming. Because of this, the tool (ntfs-3g) that mounts (opens) the partition will not mount it in read-write mode if it sees a hibernation flag. As such, Nautilus, the default file browser, will not be able to automatically open this partition--hence the error message that you see--because it is trying to open it in read-write mode.

Workaround for all versions of Windows:

There are three ways to mount a hibernated Windows partition:

Boot into Windows and power down the system by shutting it down completely. You may then boot back into Ubuntu and the partition will mount in read-write mode automatically when you open it in Nautilus. Note that the "Shut Down" option may not be the one displayed in your start menu by default. You may need to click the button next to it to see further options.

Manually mount the filesystem in read only mode.

Check to see if you have a mount point (folder for mounting your partition in) for your Windows partition in the folder /media using this command:

ls /media

If you don't see a folder for your Windows partition, you should create one with the following command:

sudo mkdir /media/windows

Next, mount the partition in read-only mode onto this folder with this command:

mount -t ntfs-3g -o ro /dev/sda3 /media/windows

Note that you should change /media/windows if your mountpoint is called something else.

Now you will be able to view/open files on your Windows partition using any program in Ubuntu. However you will not be able to write to the partition or modify any files as it is in read only mode.

If you need to mount the partition in read-write mode and are not able to or willing to boot into Windows and shut it down completely there is a third option. However, it is not included here because it completely deletes hiberfil.sys and will cause you to lose all unsaved information in the hibernated Windows programs.

Dealing with the hibernated session on the NTFS Drive:

If you want to terminate the hibernated session

sudo ntfsfix /dev/sdXY

where XY is the partition. ex: sda2 or sdb1

What if you still have access to the Windows machine and can boot into it? Then you have the option to shut it down property so you don't have to deal with a hibernated partition.

Latest versions of Windows operating systems like Windows 8.1, 10 places the RAM contents onto the hard drive before shutting down. This hibernation shutdown or hybrid sleep is a nasty feature enabled by default in Windows 10.

1. Reboot Windows 10
2. Hold down Windows and R keys together when Windows is still loading.
3. Type shutdown -s -t 00 in Run window and click OK key.
4. Wait until your system shuts down completely and boot into linux.

To disable this nasty feature of Windows 10

1. In Windows goto Control Panel -> Hardware and Sound -> Power Options -> Choose what the power buttons do.
2. opt to Change settings that are currently unavailable under System Settings
3. Uncheck Turn on fast startup option and Save changes.

Properly Shutting Down Windows

From the command prompt

shutdown -s -t 00

This will turn your machine off. You can either push enter or click on OK to power down your machine. This might take a few moments, especially if Windows decides to install updates. Just wait until the system goes down for a complete shutdown.