Add to Technorati Favorites

Monday, March 05, 2007

NTFS Architecture

When you press a start button on a computer, system BIOS started and search for first boot device. This first boot device can be set by user by entering the BIOS setup. Normally, the first boot device is a hard disk. As mention in previous topic, a formatted hard disk contains a Master Boot Record (MBR). A master boot record contains "master boot code" and partition table for the hard disk. When MBR is loaded, master boot codes are executed and search for partition table to find which partition is active or bootable. After detect an active partition, a boot sector that located at the first logical sector of the active partition, loaded in memory. This boot sector contains an executable code and data that required by the code, to determines the disk structure before loading an operating system.


When an executable codes within a boot sector are executed, it provides information to locate the NTLDR. NTLDR consist of ntldr.dll file which switches the CPU to protected mode and start the file system. NTLDR then find and reads the content of boot.ini file to start the operating system. Before starting the operating system NTLDR need to load system file driver of NTFS by executing the ntfs.sys file. After that NTLDR also need to loads the system device drivers that uses by the computer by executing the ntoskrnl.exe. This provides information about which system device drivers to load and the load order. Then, an operating system is running on the hard disk. All of the previous process loading an operating system is done in kernel mode. A kernel mode is a processing mode that allows code to directly access hardware and memory in the system.

Technorati : ,
Del.icio.us : ,
Ice Rocket : ,
Flickr : ,
Zooomr : ,
Buzznet : ,
Riya : ,
43 Things : ,

No comments: