Hardware Reference
In-Depth Information
• Files in systemroot\ System32\ Drivers (drivers)
Note
If you see error messages during startup or your system doesn't start properly, restart the
system, press the F8 key to open the startup menu, and select Enable Boot Logging to create a
file called Ntbtlog.txt. This file records events during startup and can help you determine
which files or processes are not loading correctly.
Windows Vista/7 Startup
Although Microsoft Windows Vista and Windows 7 have roots in Windows XP and earlier NT-based
Windows operating systems, the boot process is different in some significant ways. Windows Vista/7
use three different components to replace Ntldr:
• bootmgr.exe—Windows Boot Manager
• winload.exe—Windows operating system loader
• winresume.exe—Windows resume loader
Likewise, the traditional boot.ini boot configuration text file used in earlier NT-based versions of
Windows is now replaced by the boot configuration data (BCD) store. The use of BCD enables a
common interface for systems that use either traditional BIOS or the more recent extensible firmware
interface (EFI) configuration methods. The configuration options in the BCD store are changed with
the BCDEdit tool, a UAC-protected program.
Bootmgr.exe starts winload.exe, which loads Windows if no other operating system is present, using
the settings in the BCD store. However, if a dual-boot configuration has been created by installing
Windows alongside a previous version of Windows, the Windows Boot Manager displays a selection
menu listing Windows Vista/7 and the previous version of Windows. For example, if Windows 7 is
dual-booted with Windows XP, selecting the option to run the previous version of Windows causes
the Windows Boot Manager to load Windows XP's Ntldr, as noted in the previous section. However,
if Windows 7 is selected, winload.exe boots the system using the settings in the BCD store.
When a system running Windows Vista/7 is hibernated, the BCD stores information about the state of
the computer when it was hibernated. When the system resumes from hibernation, the winresume.exe
program is used to restart Windows, using the hibernation information stored in the BCD as well as
the contents of hiberfil.sys.
Windows 8 Startup
The Windows 8 startup process works in two different ways, depending upon whether the computer
is being cold-booted or being restarted after a normal Windows 8 shutdown.
The Windows 8 cold boot process works the same as in Windows 7, but the normal startup process
for Windows 8 uses both cold-boot and hibernation techniques for faster startup.
When a Windows 8 system is shut down using the normal procedure, user sessions are closed, but the
system state is hibernated. This enables Windows 8 to start the next time in its default Fast Startup
mode.
With Fast Startup, the hibernation file (hiberfil.sys) is processed after the POST is completed.
Because hiberfil.sys is much smaller than on previous Windows versions and Windows 8 uses all
