How does computer sleep mode works? How RAM holds information even if power is cut off in sleep mode?
How does computer sleep mode works? How RAM holds information even if power is cut off in sleep mode? RAM is volatile memory which erases everything when power is cut off but if i put my computer to sleep and shut down power it holds all the information when it turns on again.How RAM maintains its state during sleep mode?
memory python virtualization c# development
asked Feb 25 at 5:45
areebareeb
84
add a comment |
How does computer sleep mode works? How RAM holds information even if power is cut off in sleep mode? RAM is volatile memory which erases everything when power is cut off but if i put my computer to sleep and shut down power it holds all the information when it turns on again.How RAM maintains its state during sleep mode?
memory python virtualization c# development
asked Feb 25 at 5:45
areebareeb
84
add a comment |
How does computer sleep mode works? How RAM holds information even if power is cut off in sleep mode? RAM is volatile memory which erases everything when power is cut off but if i put my computer to sleep and shut down power it holds all the information when it turns on again.How RAM maintains its state during sleep mode?
memory python virtualization c# development
asked Feb 25 at 5:45
areebareeb
84
How does computer sleep mode works? How RAM holds information even if power is cut off in sleep mode? RAM is volatile memory which erases everything when power is cut off but if i put my computer to sleep and shut down power it holds all the information when it turns on again.How RAM maintains its state during sleep mode?
memory python virtualization c# development
memory python virtualization c# development
asked Feb 25 at 5:45
areebareeb
84
asked Feb 25 at 5:45
areebareeb
84
asked Feb 25 at 5:45
areebareeb
84
asked Feb 25 at 5:45
areebareeb
84
asked Feb 25 at 5:45
areebareeb
84
84
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
Power to RAM isn't cut off in regular sleep mode. If it is, the data is lost.
However, there are several possible modes that could be called 'sleep':
In traditional S3 "Suspend-to-RAM" sleep mode, everything is powered off except the RAM. If you cut the power supply, RAM contents are lost.
In hibernation mode everything is powered off, but the RAM contents are stored to disk (e.g. Windows puts them in a file "hiberfil.sys") before powering off, and are read back during power-on (resume).
In the "hybrid sleep" mode, the RAM contents are first stored to disk (as if hibernating), but then the computer goes into regular S3 sleep mode (leaving the RAM powered on).
When you click "Sleep" in Windows, many desktops (and occassionally laptops) are configured to use the hybrid sleep mode – which means they keep the RAM powered, but also store its contents on disk while going to sleep. So as long as the computer has power, it'll keep RAM contents in place; but if you lose power, it'll simply read the same RAM contents from the hibernation file on disk. With modern fast HDDs you hardly notice the difference.
answered Feb 25 at 6:07
grawitygrawity
242k37510567
Thanks @grawity , is it possible to read "hiberfil.sys" file using any programming language?
– areeb
Feb 25 at 6:35
You can read it (subject to permissions) but its contents are not easy to interpret. For one thing it's a copy of RAM, and relating this to virtual addresses within processes is going to take a lot of spelunking through the memory management data. Here's an old BlackHat presentation about it: blackhat.com/presentations/bh-usa-08/Suiche/…
– Jamie Hanrahan
Feb 25 at 6:46
1
It's a compressed copy of RAM, and it isn't a 1:1 copy (it skips free areas obviously, but also skips useless things like the page cache). There probably are forensic tools for examining it.
– grawity
Feb 25 at 7:12
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1409139%2fhow-does-computer-sleep-mode-works-how-ram-holds-information-even-if-power-is-c%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Power to RAM isn't cut off in regular sleep mode. If it is, the data is lost.
However, there are several possible modes that could be called 'sleep':
In traditional S3 "Suspend-to-RAM" sleep mode, everything is powered off except the RAM. If you cut the power supply, RAM contents are lost.
In hibernation mode everything is powered off, but the RAM contents are stored to disk (e.g. Windows puts them in a file "hiberfil.sys") before powering off, and are read back during power-on (resume).
In the "hybrid sleep" mode, the RAM contents are first stored to disk (as if hibernating), but then the computer goes into regular S3 sleep mode (leaving the RAM powered on).
When you click "Sleep" in Windows, many desktops (and occassionally laptops) are configured to use the hybrid sleep mode – which means they keep the RAM powered, but also store its contents on disk while going to sleep. So as long as the computer has power, it'll keep RAM contents in place; but if you lose power, it'll simply read the same RAM contents from the hibernation file on disk. With modern fast HDDs you hardly notice the difference.
answered Feb 25 at 6:07
grawitygrawity
242k37510567
Thanks @grawity , is it possible to read "hiberfil.sys" file using any programming language?
– areeb
Feb 25 at 6:35
You can read it (subject to permissions) but its contents are not easy to interpret. For one thing it's a copy of RAM, and relating this to virtual addresses within processes is going to take a lot of spelunking through the memory management data. Here's an old BlackHat presentation about it: blackhat.com/presentations/bh-usa-08/Suiche/…
– Jamie Hanrahan
Feb 25 at 6:46
1
It's a compressed copy of RAM, and it isn't a 1:1 copy (it skips free areas obviously, but also skips useless things like the page cache). There probably are forensic tools for examining it.
– grawity
Feb 25 at 7:12
add a comment |
Power to RAM isn't cut off in regular sleep mode. If it is, the data is lost.
However, there are several possible modes that could be called 'sleep':
In traditional S3 "Suspend-to-RAM" sleep mode, everything is powered off except the RAM. If you cut the power supply, RAM contents are lost.
In hibernation mode everything is powered off, but the RAM contents are stored to disk (e.g. Windows puts them in a file "hiberfil.sys") before powering off, and are read back during power-on (resume).
In the "hybrid sleep" mode, the RAM contents are first stored to disk (as if hibernating), but then the computer goes into regular S3 sleep mode (leaving the RAM powered on).
When you click "Sleep" in Windows, many desktops (and occassionally laptops) are configured to use the hybrid sleep mode – which means they keep the RAM powered, but also store its contents on disk while going to sleep. So as long as the computer has power, it'll keep RAM contents in place; but if you lose power, it'll simply read the same RAM contents from the hibernation file on disk. With modern fast HDDs you hardly notice the difference.
answered Feb 25 at 6:07
grawitygrawity
242k37510567
Thanks @grawity , is it possible to read "hiberfil.sys" file using any programming language?
– areeb
Feb 25 at 6:35
You can read it (subject to permissions) but its contents are not easy to interpret. For one thing it's a copy of RAM, and relating this to virtual addresses within processes is going to take a lot of spelunking through the memory management data. Here's an old BlackHat presentation about it: blackhat.com/presentations/bh-usa-08/Suiche/…
– Jamie Hanrahan
Feb 25 at 6:46
1
It's a compressed copy of RAM, and it isn't a 1:1 copy (it skips free areas obviously, but also skips useless things like the page cache). There probably are forensic tools for examining it.
– grawity
Feb 25 at 7:12
add a comment |
Power to RAM isn't cut off in regular sleep mode. If it is, the data is lost.
However, there are several possible modes that could be called 'sleep':
In traditional S3 "Suspend-to-RAM" sleep mode, everything is powered off except the RAM. If you cut the power supply, RAM contents are lost.
In hibernation mode everything is powered off, but the RAM contents are stored to disk (e.g. Windows puts them in a file "hiberfil.sys") before powering off, and are read back during power-on (resume).
In the "hybrid sleep" mode, the RAM contents are first stored to disk (as if hibernating), but then the computer goes into regular S3 sleep mode (leaving the RAM powered on).
When you click "Sleep" in Windows, many desktops (and occassionally laptops) are configured to use the hybrid sleep mode – which means they keep the RAM powered, but also store its contents on disk while going to sleep. So as long as the computer has power, it'll keep RAM contents in place; but if you lose power, it'll simply read the same RAM contents from the hibernation file on disk. With modern fast HDDs you hardly notice the difference.
answered Feb 25 at 6:07
grawitygrawity
242k37510567
Power to RAM isn't cut off in regular sleep mode. If it is, the data is lost.
However, there are several possible modes that could be called 'sleep':
In traditional S3 "Suspend-to-RAM" sleep mode, everything is powered off except the RAM. If you cut the power supply, RAM contents are lost.
In hibernation mode everything is powered off, but the RAM contents are stored to disk (e.g. Windows puts them in a file "hiberfil.sys") before powering off, and are read back during power-on (resume).
In the "hybrid sleep" mode, the RAM contents are first stored to disk (as if hibernating), but then the computer goes into regular S3 sleep mode (leaving the RAM powered on).
When you click "Sleep" in Windows, many desktops (and occassionally laptops) are configured to use the hybrid sleep mode – which means they keep the RAM powered, but also store its contents on disk while going to sleep. So as long as the computer has power, it'll keep RAM contents in place; but if you lose power, it'll simply read the same RAM contents from the hibernation file on disk. With modern fast HDDs you hardly notice the difference.
answered Feb 25 at 6:07
grawitygrawity
242k37510567
edited Feb 25 at 11:54
answered Feb 25 at 6:07
grawitygrawity
242k37510567
answered Feb 25 at 6:07
grawitygrawity
242k37510567
answered Feb 25 at 6:07
grawitygrawity
242k37510567
242k37510567
Thanks @grawity , is it possible to read "hiberfil.sys" file using any programming language?
– areeb
Feb 25 at 6:35
You can read it (subject to permissions) but its contents are not easy to interpret. For one thing it's a copy of RAM, and relating this to virtual addresses within processes is going to take a lot of spelunking through the memory management data. Here's an old BlackHat presentation about it: blackhat.com/presentations/bh-usa-08/Suiche/…
– Jamie Hanrahan
Feb 25 at 6:46
1
It's a compressed copy of RAM, and it isn't a 1:1 copy (it skips free areas obviously, but also skips useless things like the page cache). There probably are forensic tools for examining it.
– grawity
Feb 25 at 7:12
add a comment |
Thanks @grawity , is it possible to read "hiberfil.sys" file using any programming language?
– areeb
Feb 25 at 6:35
You can read it (subject to permissions) but its contents are not easy to interpret. For one thing it's a copy of RAM, and relating this to virtual addresses within processes is going to take a lot of spelunking through the memory management data. Here's an old BlackHat presentation about it: blackhat.com/presentations/bh-usa-08/Suiche/…
– Jamie Hanrahan
Feb 25 at 6:46
1
It's a compressed copy of RAM, and it isn't a 1:1 copy (it skips free areas obviously, but also skips useless things like the page cache). There probably are forensic tools for examining it.
– grawity
Feb 25 at 7:12
Thanks @grawity , is it possible to read "hiberfil.sys" file using any programming language?
– areeb
Feb 25 at 6:35
Thanks @grawity , is it possible to read "hiberfil.sys" file using any programming language?
– areeb
Feb 25 at 6:35
You can read it (subject to permissions) but its contents are not easy to interpret. For one thing it's a copy of RAM, and relating this to virtual addresses within processes is going to take a lot of spelunking through the memory management data. Here's an old BlackHat presentation about it: blackhat.com/presentations/bh-usa-08/Suiche/…
– Jamie Hanrahan
Feb 25 at 6:46
You can read it (subject to permissions) but its contents are not easy to interpret. For one thing it's a copy of RAM, and relating this to virtual addresses within processes is going to take a lot of spelunking through the memory management data. Here's an old BlackHat presentation about it: blackhat.com/presentations/bh-usa-08/Suiche/…
– Jamie Hanrahan
Feb 25 at 6:46
1
1
It's a compressed copy of RAM, and it isn't a 1:1 copy (it skips free areas obviously, but also skips useless things like the page cache). There probably are forensic tools for examining it.
– grawity
Feb 25 at 7:12
It's a compressed copy of RAM, and it isn't a 1:1 copy (it skips free areas obviously, but also skips useless things like the page cache). There probably are forensic tools for examining it.
– grawity
Feb 25 at 7:12
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1409139%2fhow-does-computer-sleep-mode-works-how-ram-holds-information-even-if-power-is-c%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
