What is Hiberfil.sys and Is It Safe to Delete?

You are staring at that incredibly obnoxious, glaring red bar in Windows Explorer. The one screaming that your primary C: drive has roughly twelve megabytes of free space left. Panic sets in mildly. You run a disk space analyzer like TreeSize or WinDirStat, hunting for the culprit, and sitting right there in the root directory is a massive, totally unmovable blob taking up 16 or maybe even 32 gigabytes of your precious solid-state storage. It just sits there, laughing at your storage woes. Hiberfil.sys.

You try to right-click and delete it. Windows instantly throws an “in use” access denied error, treating you like a child who just tried to unplug the television. You cannot just drag this thing to the Recycle Bin. Eventually, you hit Google and type the exact phrase on everyone’s mind: What is Hiberfil.sys and Is It Safe to Delete?

Listen closely. I am going to save you a massive headache right now. Yes, you can entirely safely get rid of this file, but you absolutely cannot do it by trying to smash the delete key. You have to tell the Windows kernel to let go of it first.

Before you go ripping out system files, you need to actually understand what this massive data chunk is doing behind the scenes. We need to talk about how your computer handles its memory when you walk away from the keyboard.

The Anatomy of a Memory Dump: Why This File Exists

Think of your computer’s Random Access Memory (RAM) as your physical office desk. When you are working, you have spreadsheets, browser tabs, Word documents, and maybe a Spotify playlist scattered all over this desk. It is fast, accessible, and right in front of you. But RAM is volatile. If the power goes out, the desk is instantly wiped clean. Everything is gone.

When you put your computer to “Sleep” (technically known as the S3 power state in the Advanced Configuration and Power Interface, or ACPI), Windows leaves all your papers on the desk. It turns off the monitor, spins down the hard drives, and puts the CPU into a low-power state, but it keeps a tiny, steady trickle of electricity flowing to the RAM sticks. This keeps your data alive. You jiggle the mouse, the screen wakes up instantly, and your messy desk is exactly how you left it.

But what if the battery dies completely while it is asleep? You lose the desk.

This is where hibernation (the S4 power state) enters the picture. When you tell Windows to hibernate, it does not just leave the papers on the desk. It meticulously takes a photographic snapshot of absolutely everything in your RAM, sweeps it all into a massive folder, and shoves that folder onto your permanent hard drive. It then completely cuts power to the entire system. Zero electricity required.

That massive folder shoved onto your hard drive? That is hiberfil.sys.

When you turn the computer back on, the Windows bootloader spots that file, reads the massive chunk of saved data, and unpacks it straight back into your RAM. Boom. Your messy desk is restored exactly as it was, even if the laptop sat in a drawer without a battery for six months.

So, getting back to the root query: What is Hiberfil.sys and Is It Safe to Delete? It is entirely safe to delete, provided you are fully willing to sacrifice the ability to put your machine into this deep, powerless coma. If you delete it, hibernation simply ceases to be an option on your machine.

A Real-World Storage Nightmare

Back in 2018, I was managing a massive Windows 10 deployment for a mid-sized accounting firm. Management decided to save a few bucks by ordering 150 laptops with incredibly cramped 128GB SSDs. Big mistake. We provisioned the machines, handed them out, and within exactly two weeks, the helpdesk queue caught fire. Users were hitting a hard wall, completely out of storage space.

Why? Because these laptops came loaded with 32GB of physical RAM to handle massive Excel financial models. By default, Windows allocates a massive percentage of your total physical RAM to the hiberfil.sys file just in case the system needs to hibernate. Out of the box, Windows was carving out roughly 13 gigabytes of permanent storage on those tiny 128GB drives before the users even saved a single spreadsheet. We had to push out an emergency Group Policy update overnight to kill hibernation globally across the network just to keep the machines booting properly.

If you have 64GB of RAM in a high-end gaming rig or a video editing workstation, that hibernation file could be sitting at a staggering 25GB or more. Just sitting there. Doing nothing 99% of the time.

The Hidden Catch: Fast Startup

Now, you might be thinking, “I never use hibernation. I always just shut my PC down completely. So this file is useless to me.”

Not quite.

Starting with Windows 8 and carrying heavily into Windows 10 and Windows 11, Microsoft introduced a feature called Fast Startup. It is enabled by default on almost every single consumer installation of Windows. Fast Startup is essentially a clever magic trick to make your computer boot faster, and it relies entirely on a miniature version of hiberfil.sys.

When you click “Shut Down” on a modern Windows machine, it does not actually perform a true, clean shutdown. It closes your user session, logs you out, and closes your applications. But it leaves the core Windows kernel and all your hardware drivers running in memory. It then takes that deeply technical system state and hibernates *only* the kernel, saving it to hiberfil.sys.

When you press the power button the next morning, Windows does not have to initialize the kernel from scratch or load all the device drivers one by one. It just reads that saved kernel image from hiberfil.sys, dumps it into RAM, and drops you at the login screen in seconds.

If you disable hibernation and wipe out the file, you also instantly break Fast Startup. Your computer will be forced to do a “cold boot” every single time you turn it on.

Does that actually matter today? Honestly, no. If you are running Windows on a modern NVMe M.2 Solid State Drive, the read speeds are so incredibly fast that the difference between a Fast Startup boot and a cold boot is maybe three seconds. You will not even notice the difference, right?

How Power States Actually Compare

To really grasp what you are turning off, you need to see the exact mechanical differences between these states. Search engines love structured data, so let’s break this down systematically.

Notice that last column. If you want Modern Standby (closing your laptop lid and opening it to instant wakefulness) or a true, clean Cold Shut Down, you do not need that massive file clogging up your hard drive.

The Step-by-Step Guide to Safely Deleting Hiberfil.sys

When clients nervously ask me, “What is Hiberfil.sys and Is It Safe to Delete?”, my immediate counter-question is always about their hardware. Are you on a desktop plugged into an uninterruptible power supply (UPS)? Kill it. Are you on a laptop with a badly degraded battery that dies without warning? You might want to keep it.

Assuming you want to claw back that precious disk space, here is the exact, foolproof method to remove it. You will use the Command Prompt, running as an Administrator, to send a direct instruction to the power configuration utility.

• Step 1: Press the Windows Key on your keyboard to open the Start Menu.
• Step 2: Type the letters cmd. Do not press Enter yet.
• Step 3: You will see “Command Prompt” appear in the search results. Right-click it and select “Run as administrator”.
• Step 4: A User Account Control (UAC) prompt will pop up asking if you want to allow this app to make changes. Click “Yes”.
• Step 5: You are now staring at a black terminal window. Click inside it and type exactly this command: powercfg.exe /hibernate off
• Step 6: Press the Enter key.

That is it. Seriously.

You will not see a success message. The cursor will just drop to the next line. But if you open Windows Explorer and look at your C: drive, you will instantly notice that 10 to 30 gigabytes of free space have magically appeared out of thin air. The operating system unhooks the file from the kernel and silently purges it from the disk instantly.

What if I Change My Mind?

Regret is a natural human emotion. Maybe you realize you actually liked Fast Startup, or maybe your laptop battery died in a coffee shop and you lost an hour of unsaved work because the machine could not hibernate at 5% battery.

Reversing the process is just as easy. Open the Administrator Command Prompt again, and type: powercfg.exe /hibernate on

Press Enter. Windows will immediately recreate the file on your C: drive and reserve the space once again.

The Middle Ground: Resizing Instead of Deleting

Perhaps you are a compromiser. You want Fast Startup to work, but you do not want to sacrifice 16GB of space for a full system memory dump. You just want the smaller, kernel-only hibernation file.

Windows actually allows you to shrink the file to a “reduced” size. This limits the file to holding only the core operating system components needed for Fast Startup, drastically cutting down its footprint on your drive while still keeping your boot times snappy.

To do this, open your trusted Administrator Command Prompt and type: powercfg.exe /h /type reduced

This command usually shrinks the hiberfil.sys file down to roughly 20% of your total physical RAM, rather than the default 40% to 75%. It is a fantastic trick for squeezing extra life out of a cramped 256GB laptop drive without sacrificing the snappy boot experience.

The Hidden Hardware Cost of Hibernation

If you are still stuck on the premise of What is Hiberfil.sys and Is It Safe to Delete?, consider the lifespan of your actual physical drive. We need to talk about SSD degradation.

Solid State Drives do not last forever. They are built using NAND flash memory, and every single cell on that drive has a finite number of times it can be written to before it physically burns out and dies. This metric is known as Terabytes Written (TBW).

Imagine you have a laptop with 32GB of RAM. Every single time you close the lid and the laptop eventually drops from Sleep into Hibernation to save battery, Windows writes a massive, multi-gigabyte chunk of data directly to your SSD. If you open and close your laptop multiple times a day, you are constantly dumping gigabytes of data onto the drive.

According to general hardware endurance standards, constantly writing an extra 15 to 20 gigabytes to a consumer-grade TLC NAND drive every single day can noticeably chew through your drive’s endurance rating much faster over a three-to-five-year lifecycle. You are essentially wearing out your hard drive just by turning the computer off.

By disabling hibernation, you drastically reduce the daily “write amplification” on your SSD. You are extending the physical lifespan of the hardware. For sysadmins managing thousands of machines, turning off hibernation is often a standard deployment practice just to reduce hardware failure rates over a five-year hardware refresh cycle.

The Linux Dual-Boot Nightmare

Here is an incredibly specific friction point that usually drives technical users absolutely crazy until they figure it out.

Let’s say you are a developer, or just a curious tinkerer, and you decide to install Ubuntu Linux alongside Windows on your machine. You want to dual-boot. You set up your partitions, install Linux, and everything seems fine. But when you boot into Linux and try to access your Windows files to grab a photo or a document, Linux throws a massive red error saying the Windows partition is locked and cannot be mounted.

Why? Fast Startup and Hiberfil.sys.

When Windows uses Fast Startup, it does not unmount the C: drive cleanly. It leaves the NTFS file system in a “dirty” state, essentially freezing it in time so it can resume quickly later. Linux sees this frozen, hibernated state and refuses to touch the drive because writing any data to it from Linux would completely corrupt the Windows kernel memory dump.

If you want to share a physical hard drive between Windows and Linux, you have absolutely no choice. You must disable hibernation. You have to open the command prompt in Windows, run powercfg.exe /hibernate off, and force Windows to completely let go of the file system every time it shuts down. Only then will Linux safely mount the drive.

Troubleshooting: When the File Refuses to Die

Sometimes, Windows fights back. You run the command, but the file stubbornly remains on your drive, mocking your administrative authority. I have seen this happen frequently in enterprise environments where third-party tweaking tools or aggressive security policies override your local commands.

If powercfg.exe /hibernate off fails to remove the file, you need to check the Windows Registry. The registry is the central nervous system of the operating system, and occasionally, the power configuration utility fails to flip the correct switch in the background.

Here is how you force it manually via the Registry Editor:

• Press the Windows Key, type regedit, and hit Enter. Accept the UAC prompt.
• Using the folder tree on the left, click your way down this exact path: HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ Power
• Look at the right-hand pane. You will see a value named HibernateEnabled.
• Double-click HibernateEnabled. Change the “Value data” box from 1 to 0. Click OK.
• Reboot your computer completely.

When the system restarts, the kernel reads that registry key, realizes hibernation is strictly forbidden, and will usually purge the orphaned hiberfil.sys file automatically.

If you are managing a fleet of computers, you can also push this exact registry change out via Group Policy Preferences, ensuring that no user accidentally turns hibernation back on and eats up all the network storage.

Virtual Machines and Server Environments

Let’s take a quick detour into the enterprise server room. If you are running Windows 10 or Windows 11 inside a Virtual Machine (VM) using Hyper-V, VMware ESXi, or VirtualBox, does that virtual machine need a hibernation file?

Absolutely not. Never.

In a virtualized setup, the host server manages the hardware states. If you need to pause a VM, you use the hypervisor’s “Snapshot” or “Save State” feature, which works infinitely better and faster than trying to make the guest operating system hibernate itself. Leaving hibernation enabled on a fleet of fifty virtual desktop infrastructure (VDI) machines means you are wasting hundreds of gigabytes of incredibly expensive SAN (Storage Area Network) space on useless hiberfil.sys files.

If you build golden master images for VM deployments, disabling hibernation should be step one on your optimization checklist.

Other Massive Files Haunting Your C: Drive

Let’s say you successfully nuked the hibernation file. You got 16GB back. But you are still hungry for more space. What else is lurking in the root directory?

Right next to where hiberfil.sys used to live, you probably noticed another massive, locked file called pagefile.sys. Do not touch this one carelessly.

The pagefile is your system’s virtual memory. When you open too many Chrome tabs and completely fill up your physical RAM, Windows starts aggressively swapping older, unused memory blocks out of the RAM and dumping them into pagefile.sys on your hard drive to prevent the entire computer from crashing. If you delete or disable the pagefile, your programs will simply hard-crash to the desktop the moment you run out of physical memory.

You can shrink the pagefile, or move it to a secondary D: drive to save space on your C: drive, but you should rarely disable it completely, even if you have 64GB of RAM. Windows expects a pagefile to exist for creating crash dump logs when you get a Blue Screen of Death.

Then there is swapfile.sys. This is a much smaller file, usually around 256MB, specifically introduced in Windows 8 to handle the suspension of Universal Windows Platform (UWP) apps—the ones you download from the Microsoft Store. It is tiny, unobtrusive, and better left alone.

The Modern Standby Dilemma

I cannot talk about power states without bringing up the absolute disaster that is Modern Standby (S0ix). If you have bought a high-end Windows laptop in the last three years, you have probably experienced this. You close the laptop lid, put the machine in your backpack, and take a flight. When you pull it out two hours later, the laptop is burning hot to the touch, the fans are screaming, and the battery is completely dead.

Microsoft designed Modern Standby to act like your smartphone. When you turn off the screen, the laptop stays connected to Wi-Fi, downloads emails in the background, and installs updates. But Windows notoriously fails at managing background processes properly. A random Windows Update service or a rogue background app will refuse to let the CPU sleep, causing the laptop to cook itself inside your bag.

Because Modern Standby is so unreliable, many power users actually rely heavily on Hibernation as a failsafe. They go into the advanced power plan settings and tell Windows: “If the laptop has been sleeping for more than 30 minutes, stop trying to use Modern Standby and force a deep, powerless Hibernation.”

If you delete hiberfil.sys, you remove this vital safety net. Your laptop will stay in that buggy Modern Standby state indefinitely until the battery physically drains to zero. If you travel frequently with a laptop in a tightly enclosed bag, you might actually want to keep the hibernation file active simply to prevent your machine from melting down.

Final Thoughts on Reclaiming Your Machine

We started this whole exhaustive tear-down trying to definitively answer: What is Hiberfil.sys and Is It Safe to Delete?

By now, the mechanics should be crystal clear. It is a massive parking garage for your active computer memory. It exists solely to allow your machine to wake up exactly as you left it without consuming a single drop of electricity in the meantime.

If you are running a desktop computer that is always plugged into the wall, or if you religiously save your work and shut down your applications before walking away, this file is nothing more than a digital hoarder taking up prime real estate on your solid-state drive. Open that command prompt, run the powercfg command, and take your storage space back.

But if you are a road warrior relying on a laptop battery that drains unpredictably, or if you absolutely demand that your machine boots to the login screen three seconds faster, leave it alone. Or better yet, compromise and use the reduced size command to get the best of both worlds.

Your computer’s storage belongs to you. Now you actually know how to control it at the kernel level.