Booting Windows

Booting Windows

1. Booting Windows XP

   • Windows XP distinguishes between the files that start the OS (called the system files) and the rest of the OS files (usually in the \Windows folder). The system files consist of three required files: ntldr, boot.ini, and ntdetect.com. If you’re using a SCSI hard drive, there is a fourth file called ntbootdd.sys. The ntldr (pronounced NT loader) file begins the boot process.
   • Boot Loader Phase
     • System Files
       • ntldr
         • The ntldr (pronounced NT loader) file begins the boot process
         • When the system boots, the master boot record (MBR) or MFT on the hard drive starts thentldr program. The ntldr program then launches Windows XP or another OS. To find the available OSs, the ntldr program must read the boot.ini configuration file, and to do so it loads its own minimal file system, which enables it to read the boot.ini file off the system partition.
       • boot.ini
         • - It is a text file that lists the OSs available to ntldr. - It tells ntldr where to find the boot partition (where the OS is stored) for each of them
         • The boot.ini file has some interesting switches that give special instructions on how the OS should boot. Sometimes Windows puts these in automatically, and sometimes you will add them manually for troubleshooting
         • /bootlog
           • Tells Windows to create a log of the boot process and write it to a file called Ntbtlog.txt.
         • /cmdcons
           • Tells Windows to start the Recovery Console
         • /lastknowngood
           • Tells Windows to boot the Last Known Good set of files
         • /noexecute
           • Newer CPUs come with Data Execute Protection (DEP) to prevent unruly programs from causing system lockups
       • ntdetect.com
         • If the ntldr determines that you have chosen to start Windows XP, it boots the system into protected mode and then calls on ntdetect.com to detect the installed hardware on the system. ntldr then refers to the boot.ini file to locate the Windows boot files.
       • ntbootdd.sys
         • Only applicable If you’re using a SCSI hard drive and has the same function as boot.ini
   • Kernel Loading Phase
     • loads ntoskrnl.exe
     • loads the registry
     • loads device drivers
   • Session Manager phase
     • loads the GUI
   • Winlogon Phase
     • loads the Login screen

2. Booting Windows Vista and 7

   • BIOS / UEFI
     • BIOS
       • the BIOS uses its boot order to scan partitions, one by one, for an MBR
       • MBR
         • holds a small bit of file-system boot code that scans the system’s partition table for the system partition and then loads its boot sector
         • Boot Sector
           • The boot sector in turn contains code that does nothing but point the boot process toward a file called bootmgr
           • bootmgr.
             • When the bootmgr starts, it reads data from a Boot Configuration Data (BCD) file that contains information about the various OSs installed on the system as well as instructions for how to load (bootstrap) them
             • Winload.exe
               • The program used to boot Windows 7. It loads the operating system kernel 
             • Winresume.exe
               • If the system is not starting fresh but resuming a previous session, then WINRESUME.EXE is called by the BOOTMGR.
           • Boot Configuration Data (BCD)
             • contains information about the various OSs installed on the system as well as instructions for how to load (bootstrap) them.
             • ntoskrnl.exe
               • Once the OS process (called ntoskrnl.exe) takes over, it loads up all the various processes and systems that make up Windows, the Windows Vista or Windows 7 logo comes up, and you’re happily computing, completely oblivious to all of the complex electronic communication that just took place inside your computer.
           • Boot options are now edited using the built-in tool bcdedit.exe
     • UEFI
       • neither the MBR nor the file system boot code is run and UEFI simply loads up bootmgr directly
       • bootmgr
         • When the bootmgr starts, it reads data from a Boot Configuration Data (BCD) file that contains information about the various OSs installed on the system as well as instructions for how to load (bootstrap) them