Make your own free website on

Windows 2000 System Files, Boot Sequence and Partitions

Working complete PC
Student Diskette, "New Boot A Ver 2.0+"
Student CD-ROM, "Windows 2000 Server OEM"
The student will become familiar with:
Windows 2000 Partitions and Volumes,
Windows 2000 Basic Disks and Dynamic Disks,
Windows 2000 Boot sequence,
Windows 2000 Boot sequence files and structures,
The student will learn the definitions and concepts of Windows 2000 partitions, volumes, basic disks and dynamic disks as well as the Windows 2000 boot sequence including the files and structures involved.
  1. Use Ghost to image a system with Windows 2000 Advanced Server from the Room 6359 Student CD-ROM.

  2. Windows 2000 Partition Compatibility
  3. Windows 2000 supports all existing Microsoft file systems that existed prior to its release. This includes the DOS/Windows 9x family file systems including FAT12, FAT16, and FAT32. Windows 2000 is also capable of reading the NTFS4 file system that was the native file system of Windows NT 4.0. The native file system of Windows 2000 is called NTFS5 and supports encryption and file compression at the file system level. This means that a data drive set up this way cannot be removed from the system that contains the booting up Windows 2000 operating system because it has encrypted the file system. When attached to another Windows 2000 machine that OS kernel does not have the randomly built encryption key and so it cannot read the file system at all.

  4. Even though Windows 2000 supports FAT32, there is a flaw. It is not built to support 32KB clusters. As a result of this Windows 2000 has a partition size limit of 32GB for FAT32. Let's say a Windows 98 PC sets up a 40GB drive as a single FAT32 partition. Later you want to attach this drive as a slave of a Windows 2000 system to copy some files onto the Windows 2000 system's hard drive. It will not recognize the drive because of the unsupported cluster size.

    The latest service pack (SP3a for W2K) will solve this issue, but you still cannot install Windows 2000 on a FAT32 partition larger than 32GB because during the installation you cannot apply the service pack...but then again maybe you can. We shall investigate this in the lab.

  5. Windows 2000 Boot Sequence
  6. The Windows NT family of operating systems are "true" 32-bit OSes. As such the 16-bit portion of the boot process has been minimized as much as possible. Also the native file system of Windows NT 4.0 and later is intended to be NTFS which is a totally new file system that accesses the disk for file storage in a completely different way from the File Allocation Table file system method. Because of this and the inherent complexity of the NTFS file system and the desire to keep this file system secure, the old DOS kernel used to boot the Windows 9x family of OSes was not modified to be able to read NTFS. It therefore cannot be used to boot Windows NT.

    Windows NT, and this discussion will deal specifically with Windows 2000 although much is inherited from previous versions of Windows NT and applies to these OSes as well, launches from the BIOS boot strap loader like any OS on the PC. As such the OS boot strap loader must be a 16-bit program nestled into the MBR just like all other OSes.

  7. This MBR OS loader will launch a much larger secondary OS loader than that which is used in the DOS/Windows 9x family of OSes. These launch by way of the MBR loader finding and loading into RAM the DBR sector which contains the secondary OS loader which will find and load IO.SYS into RAM. The secondary OS loader in Windows 2000 occupies more than a single sector but will be launched by the MBR OS loader code.

    This secodary loader will then find and load into RAM the file NTLDR. NTLDR is roughly the size of IO.SYS and has similar 16-bit low level I/O functions built into it like IO.SYS but this file's sole purpose is to launch the operating system.

  8. If the system has a SCSI controller whose BIOS does not automatically initialize during the POST such that it will present a standard low level BIOS INT13 interface for such programs as IO.SYS or NTLDR to use to access drives then the file NTBOOTDD.SYS must be present in the root of the system partition. NTLDR automatically looks for this file and loads it prior to reading BOOT.INI.

  9. NTLDR will find and read the contents of the user definable boot configuration text file named BOOT.INI. (See the Creating a Windows 2000 Boot Diskette and the Diagnostic Boot Methods and BOOT.INI Switches for more information on working with this file.) This file contains instructions on whether to present a boot menu and if so what menu choices should be offered and where they point to on the local system's hard drives. This menu will then be presented by NTLDR at boot up time.

  10. Once a choice is made or the system defaults to a choice, NTLDR will immediately launch NTDETECT.COM which will search for any hardware changes by comparing the device list that it detects against registry settings in the installation of Windows 2000 that was chosen. Obviously if Windows 2000 was not chosen then NTDETECT will not run and the other operating system will begin its boot up process from scratch.

  11. At this point NTLDR will look on the target drive for a directory named WINNT (unless it was named otherwise during the installation) and within this directory for the file NTOSKRNL.EXE. It will load this into RAM and pass control to it.

  12. NTOSKRNL.EXE (NT OS Kernel) will then find and load HAL.DLL (Hardware Abstraction Layer) into RAM. HAL is the sole system that is allowed to actually perform I/O operations with the physical devices of the computer. All other systems must make device I/O requests through HAL. Any violations of this will be dealt with mercilessly (i.e. "This program has performed an illegal operation...") or worse direct I/O attempts could result in a BSOD - Blue Screen Of Death. (See General Protection Fault)

  13. HAL.DLL will proceed to load all device drivers including third party drivers. See Dealing with ACPI in Windows 2000 for more details on this file. NTOSKRNL.EXE will continue loading the rest of the OS core and ultimately present the user with the GUI logon window.

  14. Once a valid logon occurs, Explorer.exe will load and bring all of the user's personal settings from the Registry and ultimately display the desktop and at that point the system is up and running and ready to work.

  15. Windows 2000 Boot Partition
  16. Microsoft named these two structures backwards so listen carefully...The definition of the boot partition in Microsoft references is: that partition that contains the operating system files. Another way to think of this is: the boot partition contains the WINNT folder. Now check the definition of the system partition below, to get the full effect of the backwardness.

  17. Windows 2000 System Partition
  18. Microsoft named these two structures backwards so listen carefully...According to Microsoft terminology the system partition is the structure that contains the boot strap loader and the boot up files namely: $boot (in NTFS partitions, this is the boot strap loader code), NTDETECT.COM, NTLDR, and BOOT.INI. Now check the definition of the boot partition to complete the backwardness effect of these names.

  19. Basic Disks and Dynamic Disks
  20. In Windows 2000 and beyond, a new logical disk storage type was developed called the dynamic disk. A dynamic disk is created by the Windows 2000 Disk Administrator and cannot be created by setup. Furthermore, Windows 2000 setup will not recognize a dynamic disk and cannot install the operating system onto one from scratch. The Windows 2000 Recovery Console cannot create a dynamic disk either although the XP/Server 2003 generation operating systems do possess a commandline partitioning utility that can manage RAIDs which means that it does recognize and deal with dynamic disks.

  21. It is easier to explain a dynamic disk after explaining a basic disk. A basic disk is any hard drive that relies exclusively on its master boot record partition tables for defining the partitions on that hard drive. This limits that maximum possible partition size to 4,294,967,296 sectors. The partition size is stored as a 32-bit number in the partition table which expresses the number of sectors in the partition so 232 = 4,294,967,296 sectors maximum. This value multiplied by the size of a sector (512 bytes) = 2,199,023,255,552 bytes. This is a purely binary number so dividing by 1024 yields KB, dividing by 1024 again yields MB, by 1024 again yields GB and again yields a value of 2TB. This has historically been a well chosen limit since it has yet to be reached, but the hard drive manufacturers are closing in on it.

  22. A dynamic disk on the other hand places a special partition type marker in the partition table and early in the boot process must still define a functional partition table so that the BIOS can recognize the bootable drive and begin to bootstrap the operating system from it. The operating system in the early stages of NTLDR's loading must still rely on the old BIOS compatible partition tables entirely as well, so a dynamic disk must still contain old style well defined partitions in order to boot up at least. However, when a disk is upgraded to a dynamic disk a new dynamic disk information database is created in the sectors at the very end of the drive. It can occupy a megabyte or more and contains much more sophisticated information about partitions than the old MBR partition tables. It can also define partitions up to the size limit of the NTFS file system, a 64-bit file system which has a theoretical size limitation of 16EB. Because the partition can be very precisely defined in this greatly expanded structure, this allows partitions defined on separate physical disks to operate as a logical storage group, read: RAID.

  23. Each system can contain (in Windows 2000) exactly one "disk group" which encompasses all physical disks attached to the system. All drives that are converted to dynamic disks on the system will have a complete copy of the system's disk group database written to the back end of the disk. This disk group or dynamic drive information database will contain detailed information describing each physical disk member of the disk group and all partitions or volumes defined on them. Even if other members of the system's disk group are still basic disks their information will be included in the disk group databases stored on all of the system's drives.

  24. Because the system defines the local fixed disk storage system as a hierarchy starting at a "root" structure called the "disk group" which then contains entries for all local physical disks and their partitions it can clearly map logical functional relationships between these partitions and is the effective technology that allows the system to create well defined and sophisticated software level RAIDs.

  25. Volumes and Partitions
  26. Because of the fact that partitions defined on different physical dynamic disks within the local machine's disk group can be logically related in a variety of flexible choices in ways that the old basic disk style partitions cannot support, partitions defined on dynamic disks are no longer referred to as partitions at all. Instead when a dynamic disk is divided into logical storage containers they are referred to as "volumes" to distinguish them from ordinary and highly limited partitions. In Windows 2000 a partition can only be a standalone storage container whereas a volume can be one of five possible storage structures:

  27. A Simple Volume consists of a single block of storage space the resides on a single physical disk and therefore is structurally equivalent to a basic disk partition.

  28. A Spanned Volume can occupy available free space blocks from more than one physical drive, together these blocks will appear as a single logical storage container (i.e. one drive letter). This spanned volume has no fault tolerance capabilities at all.

  29. A Striped Volume will involve equal sized storage blocks on at least two physical disks and forms a software RAID-0. Remember that RAID-0 is a performance RAID with no fault tolerance capabilities at all.

  30. A Mirrored Volume will also involve two equal sized storage blocks on two physical disks, but choosing this forms a software RAID-1. See Mirroring the Server's C: Drive for details.

  31. A RAID-5 Volume as its name implies will establish a software RAID-5 and therefore requires at least three storage blocks of equal size each on an independent physical disk. See Creating a RAID-5 Volume on the Windows 2000 Server for details.

  32. Because of the integral nature of the members of the disk group and the fact that all dynamic disks on the system hold a complete copy of the disk group database it can be seen that the system will not quickly and immediately accept changes to the disk group, drives are no longer simply "pop out the old one, pop in the new one" and the drive letters are instantly and automatically available. Adding a new disk to the system may work in the case of a simple basic disk, but it will definitely not instantly work for a new dynamic disk. The storage drivers of Windows 2000 will read all of the dynamic disk's disk group information at start up and identify the "foreigner" to the system immediately and refuse to allow the operating system to access it. Even if there are no dynamic disks on the local system, the driver's will still spot the discrepancy on the foreign disks database not listing the local system's drives and immediately "quarantine" it from automatic access. These drives are certainly accessible, but they must be imported into the local disk group using Disk Administrator. See Importing Foreign Disks for details.

  33. NTFS File System
  34. Pending...

Back to Top

Copyrightę2000-2004 Brian Robinson ALL RIGHTS RESERVED