Interactive partition map — click any partition, folder, or file to inspect its forensic role in the boot chain.
The files on this disk are only the first leg of the relay. Firmware reads the ESP → bootmgfw.efi → winload.efi → the kernel ntoskrnl.exe, which creates System (PID 4) and the first user-mode process, smss.exe. From there the boot stops being a list of files and becomes a living process tree — showing which file owns the first process, when each runs, and what it is responsible for.
Crow-Eye images and parses the disk you just explored — the ESP, the GPT, and the boot-critical files — and flags rogue .efi binaries, partition anomalies, and bootkit indicators.