Celeb Glow
general | March 25, 2026

How do I delete the Windows hibernate file on a read only device?

I'm locked out of Windows and the only way to fix it is to boot up ubuntu USB stick and delete hiberfil.sys. I managed to open the volume in a read-only mode with this command:

sudo mount -t ntfs-3g -ro remove_hiberfile /dev/sda2 /media/ubuntu

Now I have the folder/device/volume open but move to trash is grayed out because the system is in read only mode. Please tell me exactly what to write into terminal to delete it.

Update 1

What was suggested in the comments did not work:

ubuntu@ubuntu:~$ sudo mount -t ntfs-3g -rw remove_hiberfile /dev/sda2 /media/ubuntu
Usage: mount -V : print version mount -h : print this help mount : list mounted filesystems mount -l : idem, including volume labels
So far the informational part. Next the mounting.
The command is `mount [-t fstype] something somewhere'.
Details found in /etc/fstab may be omitted. mount -a [-t|-O] ... : mount all stuff from /etc/fstab mount device : mount device at the known place mount directory : mount known device here mount -t type dev dir : ordinary mount command
Note that one does not really mount a device, one mounts
a filesystem (of the given type) found on the device.
One can also mount an already visible directory tree elsewhere: mount --bind olddir newdir
or move a subtree: mount --move olddir newdir
One can change the type of mount containing the directory dir: mount --make-shared dir mount --make-slave dir mount --make-private dir mount --make-unbindable dir
One can change the type of all the mounts in a mount subtree
containing the directory dir: mount --make-rshared dir mount --make-rslave dir mount --make-rprivate dir mount --make-runbindable dir
A device can be given by name, say /dev/hda1 or /dev/cdrom,
or by label, using -L label or by uuid, using -U uuid .
Other options: [-nfFrsvw] [-o options] [-p passwdfd].
For many more details, say man 8 mount .
ubuntu@ubuntu:~$ sudo mount -t ntfs-3g -rw /dev/sda2 /media/ubuntuWindows is hibernated, refused to mount.
Failed to mount '/dev/sda2': Operation not permitted
The NTFS partition is in an unsafe state. Please resume and shutdown
Windows fully (no hibernation or fast restarting), or mount the volume
read-only with the 'ro' mount option.

Update 2

After doing:

sudo mount -t ntfs-3g -ro remove_hiberfile /dev/sda2 /media/ubuntu
sudo mount -t remount,rw /dev/sda2

I was able to use:

sudo rm -f /media/ubuntu/hiberfil.sys

The file seemed to disappear from the file browser, however it reappears immediately if I press F5.

3

1 Answer

rm did not remove the files but shred did.

sudo mount -t ntfs-3g -ro remove_hiberfile /dev/sda2 /media/ubuntu
sudo mount -o remount,rw /dev/sda2
shred -vu hiberfil.sys
shred -vu pagefile.sys
shred -vu swapfile.sys
1

Your Answer

Sign up or log in

Sign up using Google Sign up using Facebook Sign up using Email and Password

Post as a guest

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy