Interactive partition map of a Windows boot disk — MBR and GPT layouts, the EFI System Partition and the boot chain. Click any partition, folder or file to inspect its forensic role.
The files on this disk are only the first leg of the relay. Firmware reads the ESP → bootmgfw.efi → winload.efi → the kernel ntoskrnl.exe, which creates System (PID 4) and the first user-mode process, smss.exe. From there the boot stops being a list of files and becomes a living process tree — showing which file owns the first process, when each runs, and what it is responsible for.
Crow-Eye images and parses the disk you just explored — the ESP, the GPT, and the boot-critical files — and flags rogue .efi binaries, partition anomalies, and bootkit indicators.
MBR keeps its partition table in the first sector and is limited to four primary partitions and 2 TB disks. GPT stores a larger table with a backup copy at the end of the disk and is what modern UEFI systems use, so which scheme a disk uses tells you a good deal about its age and firmware.
A small FAT32 partition holding the bootloaders the firmware launches. On a Windows UEFI disk it contains the Windows Boot Manager, which makes it the place to look when investigating tampering with the boot path.
Because everything before the operating system runs is beneath the tools that run inside it. Unallocated gaps between partitions, a modified boot record and an unexpected bootloader all live here, and none of them are visible from a normal file listing.
In the Boot Configuration Data store - on the EFI System Partition for UEFI systems, and in the system-reserved partition on older BIOS/MBR installs. It records what is booted and with which options, including whether protections were disabled.