Error 0x0000028F is Windows status ERROR_VOLSNAP_PREPARE_HIBERNATE. It identifies a failure while the Volume Shadow Copy (volsnap) path prepares a volume for hibernation; it does not, by itself, prove that a hard drive is failing. The safest approach is to capture the event details, test a full shutdown, temporarily disable hibernation, and then investigate VSS, storage filters, drivers, firmware, and any recent system change.
What error 0x0000028F means
Microsoft’s error reference maps hexadecimal code 0x0000028F to ERROR_VOLSNAP_PREPARE_HIBERNATE. “Volsnap” is the Windows Volume Shadow Copy storage component. Its flush-and-hold-writes operation is used when Windows creates or manages shadow copies, and the same operation can be issued while preparing a volume for hibernation or before writing a crash dump.
As an Amazon Associate I earn from qualifying purchases.
That wording describes an operation, not a single defective part. The failing layer might be the hibernation file, Fast Startup, a VSS provider, a backup or encryption filter, a storage-controller driver, firmware, or another component in the file-system and storage stack. The code can therefore appear when you hibernate, shut down with Fast Startup enabled, resume, create a backup or shadow copy, or prepare a crash dump.
It is not automatically a hard-drive error. Hardware becomes more likely when the same computer also records disk, controller, file-system, memory, or firmware errors, freezes during ordinary use, or fails the manufacturer’s diagnostics. A single 0x0000028F event during a power-state transition is stronger evidence of a hibernation or filter-path problem than of a dead drive.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Capture the failure before changing anything
Event details tell you which operation was running and whether Windows named a provider, volume, or driver. Record the information first so a later change does not erase the most useful clue.
- Press Windows key, type Event Viewer, and open it as an administrator if prompted.
- In the left pane, open Windows Logs > System.
- Use Filter Current Log… or browse to the timestamp that matches the failed hibernation, shutdown, resume, backup, or crash.
- For each related event, copy the source/provider, event ID, exact message, timestamp, and any named driver, volume, device, or status code. Save the text in a separate file or take a screenshot.
- Note the trigger precisely: ordinary Hibernate, Sleep, Fast Startup shutdown, resume, a backup or snapshot, or crash-dump creation. Also note whether the machine rebooted, displayed a blue screen, or merely logged an event.
Look for neighboring events from storage, disk, Ntfs, volsnap, VSS, Kernel-Power, or a device driver. A provider name that appears at the same moment is more actionable than the hexadecimal code alone. Do not delete logs until you have copied the relevant entries.
Run reversible tests first
Perform a full shutdown
Fast Startup is a hybrid shutdown: Windows closes user sessions but saves a hibernation image for the kernel and drivers. A full shutdown avoids that hibernation file and is a useful comparison.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →- Save your work and close applications.
- Open Command Prompt as administrator. Search for Command Prompt, right-click it, and choose Run as administrator.
- Run
shutdown /s /t 0. - After the computer powers off, start it again and repeat the action that produced the event.
If the full shutdown succeeds but the normal Fast Startup shutdown fails, concentrate on hibernation data, dump filters, and power-management or storage drivers. If both paths fail, broaden the investigation to VSS, storage filters, drivers, firmware, and hardware.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Temporarily turn hibernation off
Disabling hibernation removes the hibernation file and also disables Fast Startup. It is a diagnostic test, not a permanent cure.
- Open an elevated Command Prompt.
- Run
powercfg /h off. - Restart Windows, then repeat the operation that triggered 0x0000028F.
- To see which sleep and hibernation states remain available, run
powercfg /a.
If the error disappears while hibernation is off, the hibernation/Fast Startup path is implicated. Re-enable it after testing with powercfg /h on, restart, and test again. If the error returns immediately, leave hibernation off while you work through the driver, filter, and configuration checks below; this also gives you a stable way to shut down the computer.
Check the Fast Startup crash-dump configuration
A documented Microsoft Fast Startup failure case uses Event ID 45 and the registry location HKEY_LOCAL_MACHINESystemCurrentControlSetControlCrashControl. In that specific scenario, Microsoft says the DumpFilters value should contain only dumpfve.sys. This is not a general instruction to remove every filter: apply it only when your event matches the documented case.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Press Windows key + R, enter
regedit, and press Enter. Approve the User Account Control prompt. - In Registry Editor, select File > Export. Export the selected branch or the whole registry to a known location before editing.
- Navigate to
HKEY_LOCAL_MACHINESystemCurrentControlSetControlCrashControl. - Inspect the
DumpFiltersvalue. Do not change it merely because you see 0x0000028F; first confirm that the event is the documented Event ID 45 Fast Startup case and that the value contains an unexpected filter. - If the documented conditions match, follow Microsoft’s guidance so that
dumpfve.sysis the only entry. Close Registry Editor and restart.
Registry edits affect boot and crash-dump behavior. If Windows becomes unstable after an edit, boot into Windows Recovery Environment, use System Restore if a restore point exists, or restore the exported registry data from a working installation. Never remove a filter belonging to encryption, backup, security, or storage software without checking that product’s recovery instructions.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Review VSS, backup, encryption, and storage filters
Volsnap does not operate in isolation. File-system and storage drivers can intercept the flush-and-hold-writes request. A recently installed or updated backup program, snapshot provider, full-disk encryption component, antivirus filter, virtual-disk utility, or storage-management tool can therefore be involved.
Inventory software that can sit in the storage path
- Backup and disk-imaging applications, especially those that create bootable recovery media or shadow copies.
- Encryption products and virtual-disk tools.
- Security software that installs file-system or disk filters.
- Storage caching, RAID, SSD-management, and vendor controller utilities.
- Virtual-machine, sandbox, or snapshot software that accesses volumes directly.
Use timing to isolate a change
Compare the event timestamp with installation and update history. If the problem began immediately after one of these products or a driver was installed, update it first using the vendor’s documented package. If no compatible update exists, temporarily remove or disable the recently changed component according to the vendor’s procedure, reboot, and retest. A clean result identifies a suspect; it does not prove that every installation of that product is defective.
Do not stop or delete VSS providers at random. Removing a provider can make existing backups or recovery jobs unusable. Keep a current backup of personal files before uninstalling storage software, and make sure you have the product’s reinstall or recovery media.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsUpdate or roll back the drivers and firmware in the path
Power transitions exercise more than the disk driver. Storage-controller, chipset, firmware, graphics, and power-management components can all be involved in hibernation and resume. Use the computer maker’s support page or the component maker’s official download for your exact model and Windows edition.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
- Open Device Manager by right-clicking Start and selecting Device Manager.
- Expand Storage controllers, IDE ATA/ATAPI controllers, System devices, Display adapters, and any category containing the device named in Event Viewer.
- Open a device’s Properties > Driver tab and record the provider, date, and version. In Events, check when Windows installed or failed to start the device.
- Install the storage-controller and chipset packages supplied for your exact PC or motherboard. Apply BIOS/UEFI or SSD firmware only when the manufacturer identifies your model and provides recovery instructions.
- Restart and repeat the failing operation. If the issue began after an update, use Properties > Driver > Roll Back Driver when available, or reinstall the previous package supplied by the manufacturer.
Avoid driver sites that cannot identify the hardware and package provenance. If BitLocker or another encryption system is enabled, keep its recovery key available before firmware or storage-controller work. Firmware updates can interrupt boot if power is lost, so use reliable AC power and follow the manufacturer’s procedure exactly.
Check for a Memory Integrity driver block
Windows Security may report that a driver cannot load because Memory Integrity is preventing it. Microsoft describes this message as a protection feature blocking an incompatible driver. The blocked driver may be related to storage, backup, encryption, or another device and can explain a power-state failure.
- Open Windows Security from the Start menu.
- Select Device security > Core isolation details.
- Read the driver name shown under Memory integrity, if Windows reports one.
- Search Windows Update and the computer or component manufacturer for a compatible replacement. Install that update and restart.
Turning Memory Integrity off lowers protection and should be reserved for a short diagnostic test when no compatible driver exists. If you must test it, record the original setting, switch it off only long enough to reproduce the problem, restart, and turn it back on afterward. A disappearance of 0x0000028F with the setting disabled points to driver compatibility; it is not a reason to leave the protection reduced indefinitely.
Determine whether storage hardware is involved
0x0000028F alone cannot distinguish software from hardware. Escalate hardware checks when the logs show disk or controller errors, Windows reports corrupted files, applications freeze during ordinary reads and writes, or the problem continues with hibernation disabled.
- Run the PC or motherboard manufacturer’s storage diagnostic. For an add-in SSD, use the drive manufacturer’s diagnostic and firmware utility.
- Run the manufacturer’s memory test if you see unexplained crashes, corrupted archives, or different stop codes.
- Check that the drive is firmly seated and that SATA or power cables are secure, but power the computer off and follow antistatic precautions before opening it.
- Review Event Viewer for recurring disk, Ntfs, storahci, stornvme, or controller events. Record their IDs and timestamps rather than relying on the 0x0000028F entry alone.
- Back up important files before stress testing a drive that reports errors. If diagnostics report an impending failure, replace the drive and restore the backup instead of repeatedly forcing hibernation.
Do not use a destructive “repair” option until you have a backup and understand what it changes. A diagnostic result that passes storage and memory, combined with a clean full shutdown, makes a software path conflict more likely than a failing disk.
Repair Windows components only after isolating the trigger
System-file repair can help when Windows components are damaged, but it will not correct an incompatible third-party filter or faulty firmware. Use it when Event Viewer or other symptoms indicate component corruption, or after the reversible tests point to a Windows installation problem.
- Open an elevated Command Prompt.
- Run
sfc /scannowand wait for it to reach 100 percent. Note whether it repaired files, found corruption it could not repair, or found no integrity violations. - If SFC cannot repair files, run
DISM /Online /Cleanup-Image /RestoreHealth. Keep the computer connected to a reliable network if Windows needs source files. - Restart and run
sfc /scannowagain. Retest Hibernate, Fast Startup shutdown, and the operation that originally logged 0x0000028F.
Keep the command results with your event notes. If repair commands complete successfully but the same provider and event return, continue investigating the named filter or driver rather than repeating the commands.
Choose the next action from the evidence
| Observed pattern | Most useful next test | Why it fits | Risk or security impact |
|---|---|---|---|
| Full shutdown works; Fast Startup or Hibernate fails | Leave hibernation off temporarily, then inspect DumpFilters and power-management drivers | Separates the hibernation image path from ordinary shutdown | Disables Hibernate and Fast Startup until re-enabled |
| Event ID 45 names the documented Fast Startup case | Back up the registry and check the CrashControl DumpFilters value | Matches Microsoft’s specific configuration guidance | Incorrect registry edits can affect crash dumps and boot behavior |
| Backup, snapshot, encryption, or security software appears at the same timestamp | Update or temporarily remove that provider using its vendor procedure | Third-party filters can intercept volsnap operations | May affect backups, encryption, or protection; keep recovery material ready |
| Problem began after a driver or BIOS change | Install the manufacturer’s current package or roll back the change | Restores a known-good driver/firmware baseline | Firmware updates require stable power and exact model matching |
| Memory Integrity names an incompatible driver | Find a compatible replacement; disable Memory Integrity only briefly if unavoidable | Tests whether the blocked driver is the failing layer | Disabling the feature reduces protection |
| Disk, controller, or memory diagnostics fail | Back up data and follow the manufacturer’s replacement or repair process | Independent hardware evidence outweighs the status code alone | Repeated testing can worsen a failing drive; preserve data first |
When Windows still logs 0x0000028F
At this point, keep hibernation disabled so the computer remains usable, and collect a complete case record: the exact event text, provider and event ID, timestamps, trigger, installed backup or encryption products, driver versions, BIOS/UEFI version, and diagnostic results. If the event names a volume or driver, provide that name to the PC or component manufacturer. If the machine cannot boot normally after a change, use Windows Recovery Environment to undo the last driver or registry edit, then restore the exported registry backup or a restore point.
A clean full shutdown does not prove that every storage operation is healthy, and a failed hibernation test does not prove that the disk is bad. The useful conclusion comes from the combination of trigger, neighboring events, reproducibility with hibernation disabled, and results from driver, filter, and hardware checks.
Quick Recap
As an optional shortcut after the manual checks, Outbyte PC Repair can address more than 100 common Windows issues where possible, tune settings that contribute to CPU, RAM, or disk load, clean temporary and cache files, check Windows settings and missing updates, provide privacy and file-shredding tools, and record app crashes. It runs on Windows 11, 10, 8, and 7; a free trial is available by category for at least two days before a paid subscription. It complements antivirus software rather than replacing it, results vary, and no tool repairs every crash.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
