Cautionary hibernation tale

[guero61]

To hopefully save someone else from this horrid fate, beware when you hibernate - either always resume or MAKE SURE your hibernated image (swap/file/whatever) is shredded, zeroed out, or otherwise eliminated.

I have my laptop set up to hibernate whenever the battery hits 0%, regardless of what I'm doing. The other day, I elected not to resume for one reason or another, and went on with life. Hours later when I rebooted, my default GRUB configuration pointed me back at the [still saved] resume image. Everything resumed just fine, but everything thereafter went to crap - every file that had changed inodes (i.e., I had edited, since I use ext3 on my root and XFS in /var and other places) now had a completely different file in it's place, was missing, or zeroed out! For example - /etc/make.conf was some screwed up Mozilla/Netscape config file, sudoers was zeroed out, and so on - absolute chaos. Luckily, I had sleuthkit installed and was able to munge back through unallocated space in my root partition and recover most of my critical files.

The moral of the story is thus: make sure you NEVER go back to an old 'resume=' image unless you know precisely what you're doing. If you're using swap space as your 'resume=' argument to your kernel, enable 'RC_SWAP_ERASE' in /etc/conf.d/rc or store your suspend file in /tmp and turn on WIPE_TMP in /etc/conf.d/bootmisc. IIRC, suspend2 does have protections against this, but for the moment I was using gentoo-sources

There is one other story I can find about this, but it seems they may not have known precisely what had happened.