10

Microsoft Windows has a feature where, when shutting down, it will actually go into a state of hibernation instead of fully shutting down, to boot faster in the future (though this can be disabled). This preserves the state of the kernel and system session while locking down the Windows partition to prevent editing and corruption of data. This information can be found here.

I personally have also come across this feature when dual-booting Windows and Ubuntu and trying to access my Windows files from Ubuntu.

How does this drive locking down work? For example, does it rely on the other operating system respecting the drive lockdown (like setting a lockdown bit) or does it completely prevent the other OS from modifying the data (like drive encryption, which it clearly isn't because the files can be read, but not written to). Can the drive be unlocked by another operating system?

Improve this question

1 Answer 1

Reset to default
12

Windows uses a "dirty" bit on the drive to notify the system whether it has been cleanly shutdown.

From HAL9000 on the Raymond.cc blog: Manually Reset or Clear Dirty Bit in Windows without using CHKDSK

One mystery that has gone unsolved for the longest time now is the dirty bit on hard drive volumes. Basically a dirty bit is just a 1 hex value located somewhere hidden on the hard drive that Microsoft has never reveal until recently. Windows will check the dirty bit to determine if a volume can contain corrupted files due to hard resetting your Windows computer with files that are still opened or when you unplug a USB flash drive that is in the midst of copying a file.

It serves the same purpose under Fast Startup, as the system is hibernated it has not been fully shutdown and so is considered "dirty" as the hibernated system may have files open or data ready to write.

Linux, or at least some version of it, can respect the dirty flag and refuse to open the disk as read-write, reverting to read-only.

Failure to respect the flag will cause Windows to believe that the disk may have been corrupted as other contents of the disk may not agree with the operating system stored data.

Also, from FOG Wiki:Windows Dirty Bit

The Windows "dirty bit" is set ON when:

  • There are pending Windows updates
  • There is a pending restart
  • Fast Startup is enabled
  • Windows is hibernated
  • Windows is improperly shutdown
  • There is a chkdsk scheduled
  • Data corruption is detected

...

Windows 8.0, 8.1, and 10 (and most likely future Windows versions) have a feature called "Fast Startup". This feature basically sets windows so that a hibernation occurs whenever the system is shutting down. This enables Windows to startup much faster than in past Windows versions. Because this feature is on by default, the windows OS partition has a hibernation file which prevents mounting and imaging via FOG, and also marks the OS partition's "Dirty Bit" to ON. Even when hibernation and fast startup is disabled, the hibernation file remains and the "Dirty Bit" remains ON and these things causes problems. There are a few ways to fix/get around this.

Improve this answer
4
  • I would add something that I noticed. When I hibernate with dual boot, OS chooser screen never shows when I power on the computer. So effectively I can only boot into the same OS without any choice. If I remember correctly, even USB flash drive don't boot if I hibernate.
    – user398328
    Commented May 24, 2020 at 15:35
  • @VarunAgw Are you thinking of hibernate or sleep? As far as I know, hibernate is a normal shutdown from a BIOS point of view but sleep is a special state.
    – Dan
    Commented May 24, 2020 at 20:03
  • @VarunAgw As Dan mentions sleep is also involved here. Windows does a "Hybrid sleep" where it hibernates as well as suspends to RAM, should power be lost then the system simply restores from hibernation, otherwise the suspend to RAM makes startup seem like it was never shut down at all. Sleep would bypass the standard hibernation "boot from disk" procedure.
    – Mokubai ♦
    Commented May 24, 2020 at 20:13
  • @Mokubai Ah. Interesting point. I didn't know of it. That explains my observation.
    – user398328
    Commented May 24, 2020 at 21:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .