Understanding How Windows XP Starts
After the computer starts and hands off the process to the operating system, Windows XP continues to load in the following manner:
1. The MBR is a small program typically found on the first sector of a hard drive. Because the MBR is so small, it cannot do much. In fact, the MBR that is used in Windows XP has only one function: it loads a program named NTLDR into memory.
Tip
NTLDR is probably a name that you recognize. When a computer tries to start from a disk that is not bootable, but has been formatted with a file system that is compatible with Windows XP, you will often see the message "NTLDR is missing. Press CTRL+ALT+DEL to restart" (or something like it). If you see this message, Windows is telling you that either the disk that you are trying to start from is not a valid boot disk (maybe a floppy disk is still in the drive) or that the NTLDR file is invalid.
2. NTLDR switches your computer to a flat memory model (thus bypassing the 640 KB memory restrictions placed on PCs) and then reads the contents of a file named BOOT.INI. The BOOT.INI file contains information on the different boot sectors that exist on your computer.
3. If a computer has multiple bootable partitions, NTLDR uses the information in the BOOT.INI file to display a menu. That menu contains options on the various operating systems that you can load. If a computer has only one bootable partition, NTLDR bypasses the menu and loads Windows XP.
4. Before Windows XP loads, NTLDR opens yet another program into memory named NTDETECT.COM. NTDETECT.COM performs a complete hardware test on your computer. After determining the hardware that is present, NTDETECT.COM gives that information back to NTLDR.
5. NTLDR then attempts to load the version of Windows XP that you selected in Step 3 (if you selected one). It does this by finding the NTOSKRNL file in the System32 folder of your Windows XP directory. NTOSKRNL is the root program of the Windows operating system: the kernel. After the kernel is loaded into memory, NTLDR passes control of the boot process to the kernel and to another file named HAL.DLL. HAL.DLL controls Windows' famous hardware abstraction layer (HAL), which is the protective layer between Windows and a computer's hardware that enables such stability in the Windows XP environment.
6. NTOSKRNL handles the rest of the boot process. First, it loads several low-level system drivers. Next, NTOSKRNL loads all the additional files that make up the core Windows XP operating system.
7. Next, Windows verifies whether there is more than one hardware profile configured for the computer (see Chapter 6 for more information about hardware profiles). If there is more than one profile, Windows displays a menu from which to choose. If there is only one hardware profile, Windows bypasses the menu and loads the default profile.
8. After Windows knows which hardware profile to use, Windows next loads all the device drivers for the hardware on your computer. By this time, you are looking at the Welcome To Windows XP boot screen.
9. Finally, Windows starts any services that are scheduled to start automatically. While services are starting, Windows displays the logon screen.
