The booting process has evolved over time to enhance security and usability, with many changes occurring. This overview will discuss the major changes, serving as an entry point for understanding the booting process, which is more complex than described here.
What is Booting?
The booting process involves loading the operating system into RAM for use. There are two types of booting:
- Cold Boot:When a computer starts after being powered off.
- Warm Boot:When the computer restarts without turning off the power supply, and hardware initialization isn't performed again.
For the sake of clarity, in this article "boot" from now on indicates a cold boot.
🔍 Forensic Significance
Understanding the boot process is critical for digital forensics investigators:
- Bootkit Detection:Malware that infects boot sectors can persist across OS reinstalls
- Timeline Analysis:Boot timestamps reveal system installation and modification times
- Partition Analysis:Hidden or deleted partitions may contain evidence
- Secure Boot Verification:Detect unauthorized OS or bootloader modifications
- Anti-Forensic Detection:Boot-level anti-forensic tools leave traces in boot sectors
Key Technologies & Terms
To ensure a good understanding of this article, here is a brief overview of the terms you will need to know:
Firmware
Software designed to provide low-level control of hardware. It's typically stored in non-volatile storage like ROM and is responsible for locating bootable devices. Two types discussed here are BIOSand UEFI.
MBR Structure
Active Partition
A partition marked as bootable that contains the boot files. Only one partition can be marked as active in MBR systems.
Windows XP and Earlier (BIOS & MBR)
The main idea for all versions of Windows booting is to find and start a program that will start Windows loading operation (NTLDR or Winload.exe).
📊 MBR Structure (512 Bytes)
🔍 Forensic Note: MBR Analysis
Key Artifacts:
- Location:Sector 0 (LBA 0) of physical disk
- Signature Verification:Last 2 bytes must be 0x55AA
- Bootkit Indicators:Modified bootstrap code, unusual partition entries
- Tools:dd, FTK Imager, X-Ways can extract MBR for analysis
🔄 BIOS/MBR Boot Flow (Interactive)
Key Boot Files (Windows XP)
NTLDR
Location:Root of system partition
Purpose:NT Loader - boot manager and system loader
Forensic Value:Timestamp indicates system installation/modification
boot.ini
Location:Root of system partition
Purpose:Configuration file specifying boot options and OS paths
Forensic Value:Reveals multi-boot configurations and OS locations
MBR Limitations
- Max 2TB disk size
- Only 4 primary partitions
- No redundancy (single point of failure)
- 16-bit code (slower)
- Limited security features
- Text-based interface
- No Secure Boot support
✨ UEFI/GPT Advantages
- Supports disks>2TB (up to 9.4ZB)
- 128 partitions by default
- Backup GPT header (redundancy)
- 32/64-bit code (faster boot)
- Secure Boot capability
- Graphical interface support
- Network boot (PXE) support
New Technologies
GPT (GUID Partition Table)
The updated version of MBR. It supports larger disk spaces, handles many partitions, and has better compatibility with UEFI.
GPT Disk Structure (Interactive)
Hover over each block to see details:
🔍 Forensic Note: GPT Analysis
Key Artifacts:
- Primary Header:LBA 1 (sector 1)
- Backup Header:Last sector of disk
- Partition GUIDs:Unique identifiers for each partition
- Type GUIDs:Identify partition purpose (ESP, Windows, Recovery, etc.)
- Tools:gdisk, TestDisk, GPT fdisk for analysis and recovery
BIOS+GPT Compatibility
⚠️ Important: BIOS Can Boot from GPT Disks
While UEFI is designed for GPT, BIOS can also boot from GPT diskswith limitations:
- Requires BIOS Boot Partition:A small (1-2MB) unformatted partition with
type GUID
21686148-6449-6E6F-744E-656564454649 - Used by GRUB2:Linux bootloaders commonly use this method
- Windows Limitation:Windows cannot boot from GPT on BIOS systems (requires UEFI)
- Forensic Indicator:Presence of BIOS Boot Partition indicates BIOS+GPT configuration
Why MBR Cannot Work with UEFI:
- No ESP Support:MBR has no concept of EFI System Partition required by UEFI
- Partition Limit:UEFI firmware expects GPT's extended partition capabilities
- Security:UEFI Secure Boot requires GPT's partition GUIDs for verification
- Compatibility Mode:UEFI can boot MBR disks via CSM (Compatibility Support Module) - legacy BIOS emulation
🔄 UEFI/GPT Boot Flow (Interactive)
Key Boot Files (Windows Vista+)
bootmgfw.efi
Location:\EFI\Microsoft\Boot\bootmgfw.efi (ESP)
Purpose:Windows Boot Manager for UEFI systems
Forensic Value:Timestamp and signature verification status
winload.efi
Location:\Windows\System32\winload.efi
Purpose:Windows OS loader
Forensic Value:Loads kernel and critical drivers
BCD
Location:\EFI\Microsoft\Boot\BCD (ESP)
Purpose:Boot Configuration Data store
Forensic Tool:bcdedit /export to extract for analysis
winresume.efi
Location:\Windows\System32\winresume.efi
Purpose:Resume from hibernation
Forensic Value:Indicates hibernation capability
🔍 Forensic Investigation Checklist
Boot Artifact Collection:
- ✓ Extract MBR/GPT (first 34 sectors + last 33 sectors)
- ✓ Image ESP partition (contains boot configuration)
- ✓ Export BCD with bcdedit /export
- ✓ Document Secure Boot status (enabled/disabled)
- ✓ Check for BIOS Boot Partition (BIOS+GPT indicator)
- ✓ Analyze boot file timestamps (installation/modification timeline)
- ✓ Verify boot file signatures (detect tampering)
- ✓ Document firmware settings (boot order, Secure Boot keys)