Windows wouldn’t hibernate with Error Event ID 45: volmgr

Just to share my 3-day battle with Windows 7 32bit Pro after it was installed on the Kingston V+100E Self-encrypting SSD 64GB.

To be fair, the problem has little to do with the Kingston SSD actually. There may be incompatibility with Truecrypt 7.1 & Self-encrypting SSD, or it could be old registry entries left-over from my old encrypted HDD but I didn’t investigate further since I’ve solved my hibernation problem.

Update at the end of this article!

*******************************

System:

OS: Win7 32bit Pro (New install, not upgrade)

Laptop: Fujitsu T4215 with CPU upgraded to Intel T7200

HDD: WD Scorpio Black 320GB (Truecrypt 7.1 System FDE) -> Kingston V+100E 64GB (Self-encryption)

Drivers: (All updated to latest from manufacturer)

********************************

Everything seems to work well until I run Easy Transfer to transfer my account from my old HDD to the new SSD. My old WD Scorpio Black was encrypted using Truecrypt 7.1 so there were active Truecrypt registry entries which I’m not aware of & few people seem to know about. Google it & you would’t find many entries if any.

Hibernation will always fail with black screen. When KB/Mouse is touched, the login screen is shown. Event Viewer will show Event ID 45 Error caused by volmgr on \device\harddiskvolume2 (which is my C:\). What’s cryptic is the error is a crash dump driver error. What has crash-dumping in volmgr.sys got to do with hibernation?

A lot in fact, after kernel-mode drivers had crashed or unloaded, the only way the NT Kernel could do stuff is through special filters apparently. So to activate Hibernation, the Kernel has to unload everything & dump everything in RAM to HDD. What if you’re running Bitlocker or Truecrypt, which are software-based encryption?

The Kernel has to filter the RAM data thru these small programs so the Hibernation or Crash dumps are encrypted as well, else there’ll be a security risk. dumpfve.sys for Bitlocker & truecrypt.sys for Truecrypt 7. Unfortuntately I don’t see this documented anywhere. (I did not search SourceForge though.) I found out when I was hunting in the registry.

This registry key is where I found the offending entry.

HKLM\SYSTEM\CurrentControlSet\Control\CrashControl -> DumpFilters

In it, I found “dumpfve.sys” & “truecrypt.sys”. Now I did not install Truecrypt in the new system so the only way is thru’ Easy Transfer.

OK, fine, so I install Truecrypt 7.1 to make sure the proper files are installed. But after rebooting, Windows BSOD & I couldn’t see any crash dump! It may be that active Truecrypt registry is still there thinking the SSD was encrypted. Well I can’t have that! So I did a System Restore & booted up. I then remove the truecrypt.sys entry in all Registry keys, adjust my pagefile size, enabled crash dump 128KB & enabled hibernation with “-size 100”.

Hit the Hibernation button & it WORKS!!!

After that, whatever changes I did to pagefile.sys & crash dump size did not affect Hibernation.

So for those of you who have hibernation problems with Event ID 45 from volmgr. Check your crashdump filter.

Now I still need Truecrypt to access the old encrypted WD Scorpio Black, so what I did was to install Truecrypt in “Portable” mode & run the .exe files instead of an installation. Done!

Update (19/3/2012):

Recently I cleaned the registry of all entries with Truecrypt & install the latest 7.1a version & Windows did not BSOD so I’m a happy camper again. Seems like Truecrypt doesn’t leave many entries in Windows itself, which is a GOOD thing!

Thanks to (original source)

You can leave a response, or trackback from your own site.

Leave a Reply