Hey Investigator,

Have you ever felt confused by Windows booting? Don't worry—it's one of the most misunderstood topics in forensics. To most, it's just a spinning circle on a screen. To us, it's a high-stakes relay race where critical files and firmware phases must "hand over" control perfectly.

This guide is designed to take you from the very first spark of power to the moment you see your desktop, clarifying every technical "trap" along the way—even if you've never heard of these terms before.

1. The Big Picture: What is "Booting"?

Simply put, Booting is the process of loading the Operating System (OS) from your slow hard drive into your fast RAM so the CPU can start running it.

The Golden Rule: The main and overall idea for all versions of Windows booting is to find and start a program that will start the Windows loading operation (by the NTLDR or Winload.exe).

The Two Types of "Starts":

In this guide, when we say "Boot," we are talking about a Cold Boot.

🧩 2. The Core Vocabulary (No Knowledge Assumed)

Before we move on, let's define the "players" in our story:

⚡ POST (Power-On Self-Test) — The Health Check

The very first diagnostic test run by your computer. It checks if your CPU is working, if your RAM is present, and if your hardware is responding. If the POST fails, the computer will stop booting immediately.

🧠 NVRAM (Non-Volatile RAM) — The Motherboard's Memory

A tiny chip on your motherboard that keeps its memory even when the power is off (using a small CMOS battery). It's the "Settings Store" for your firmware. It remembers your Boot Order, your Date/Time, and your Secure Boot keys.

🗂️ File Systems — The Disk's Language

A File System is the "Grammar" of your disk. It organizes raw data into a human-readable structure.

FAT32 (The Simple Language): Universal and simple. Used for the ESP (EFI System Partition) because every firmware speaks FAT32.

NTFS (The Powerful Language): Used for the Windows (C:) Partition. Supports security permissions, large files, and "Journaling" (recovering from crashes).

🖥️ UEFI (Unified Extensible Firmware Interface) — The Mini-OS

The modern replacement for BIOS. It's much smarter and more powerful. It understands FAT32 and can verify "Digital Signatures" to ensure the code hasn't been tampered with. It also enforces Secure Boot.

🗺️ GPT (GUID Partition Table) — The Map

The modern replacement for MBR. It tells the computer exactly where each partition starts and ends. It is much safer because it keeps a backup of itself at the end of the disk.

📋 BCD (Boot Configuration Data) — The Boot Registry

A structured database (similar to the Windows Registry) that tells the Boot Manager everything: which OS to load, where to find it, and which security settings are active.

Forensic Role: Attackers may disable integrity checks inside the BCD to load unsigned or malicious drivers. Always inspect it.

Quick BCD commands for investigators:

bcdedit /enum all          → show all boot entries
bcdedit /enum firmware     → show UEFI boot entries
bcdedit /enum {bootmgr}   → show boot manager settings

🕰️ 3. The Evolution: Why did the Boot Process Change?

Windows booting has evolved over the last 30 years for three main reasons: Capacity, Security, and Speed.

The "Old Guard" (BIOS + MBR) — Legacy Flow:

Power → POST → BIOS → MBR → VBR → NTLDR → ntoskrnl.exe

Drawbacks:

📊 MBR Structure (512 Bytes)

Bootstrap Code
446 bytes (0x000-0x1BD)
Contains executable code to load boot sector
Partition Table
64 bytes (0x1BE-0x1FD)
4 entries × 16 bytes each
Signature
2 bytes (0x1FE-0x1FF)
0x55AA

The "Modern Guard" (UEFI + GPT) — Modern Flow:

Power → POST → UEFI → Bootmgfw.efi → Winload.efi → ntoskrnl.exe → smss.exe → winlogon.exe

Improvements:

📊 GPT Disk Structure (Interactive)

🛡️ Protective MBR (LBA 0)
Fake MBR to prevent legacy tools from corrupting GPT disk
📋 Primary GPT Header (LBA 1)
Contains: Disk GUID, partition table location, CRC32 checksums
📊 Partition Table (LBA 2-33)
128 partition entries (Name, GUID, Type)
💾 Primary Partitions (Data Area)
Actual user data and OS files (ESP, Windows, Recovery)
📊 Backup Partition Table
Duplicate for redundancy
📋 Backup GPT Header (Last LBA)
Mirror of primary header

🛡️ 4. Deep Dive: The OS Loaders (Legacy vs. Modern)

The loader is the bridge between the firmware and the Windows Kernel.

A. NTLDR (The Legacy All-in-One) — XP and Earlier

In older systems, NTLDR (NT Loader) performed multiple roles at once:

Role 1: Boot Manager

It read the boot.ini file to show you a menu of which OS to start.

Role 2: Hardware Detector

It ran a program called NTDETECT.COM to find basic hardware like your keyboard and mouse.

Role 3: Loader

It loaded the kernel (ntoskrnl.exe) and the HAL (Hardware Abstraction Layer) into memory together.

📄 boot.ini: The Legacy GPS

What is it? A simple text file in the root of the C:\ drive. It tells NTLDR where Windows partitions are using ARC (Advanced RISC Computing) paths.

Forensic Role: If you see a modified boot.ini, an attacker might be trying to redirect the boot process or load a hidden OS.

🔌 NTDETECT.COM: The Legacy Scout

What is it? A 16-bit "Real-Mode" program used by NTLDR. Its only job is to scan hardware (Keyboard, Mouse, Disk, Video) and pass that "Hardware Map" back to NTLDR, which then gives it to the Kernel.

B. Winload.exe / Winload.efi (The Modern Bouncer) — Vista to Win 11

In modern Windows systems (Vista through Windows 11), the boot responsibilities are strictly split. While bootmgfw.efi acts as the manager, Winload is specifically the OS Loader. It acts as the final gatekeeper before the Kernel takes over.

The Bouncer: Signature Verification

Its primary job is KMCS (Kernel Mode Code Signing). Winload verifies the digital signature of every driver that is set to start at boot. If a driver is unsigned or the signature is invalid, Winload will block it from loading. This is a critical defense against rootkits that try to insert themselves into the boot process.

The Messenger: Loader Parameter Block

It prepares a massive, complex data structure called the LOADER_PARAMETER_BLOCK. Think of this as a "briefcase" passed to the Kernel containing the memory map, the SYSTEM registry hive, and the list of boot drivers.

🔍 Forensic Note: Winload Analysis

Winload.efi (UEFI) and Winload.exe (Legacy BIOS) both exist on modern systems. On a UEFI system, the presence of winload.exe in the BCD as the primary loader is highly suspicious and could indicate an attempt to bypass Secure Boot via legacy emulation.

Investigation: A modified Winload can be patched to silently disable KMCS, allowing malicious unsigned drivers to load. Always verify the hash of winload.efi against a known-good baseline for that specific Windows build.

🎮 Interactive Boot Explorer

Want to see exactly where these files live on the disk? Explore our interactive partition map to see the relationship between the ESP, the Windows partition, and the boot-critical files.

Open Disk Explorer

🔐 Secure Boot — The Gatekeeper

What is it? UEFI feature that cryptographically verifies every .efi binary before allowing execution.

How it works: UEFI stores trusted certificate keys in NVRAM. It checks the signature of bootmgfw.efi or winload.efi against those keys.

Forensic Role: Attackers bypass it by enrolling rogue certificates, exploiting signed-but-vulnerable bootloaders (BootHole), or disabling it entirely.

Investigator Check: Look for unexpected keys in the Secure Boot database or a disabled state in UEFI/NVRAM dumps.

🏢 5. The User-Mode Builders: SMSS and Winlogon

Once the Kernel is initialized, it creates the first user-mode process: smss.exe.

🏛️ smss.exe: The "First Citizen" of User Mode

Responsibilities: Creates system environment variables, starts the Kernel-mode graphics engine (win32k.sys), manages user sessions, and starts winlogon.exe.

Forensic Tip: SMSS should never have a parent other than System (PID 4). If it does, it's likely malware.

🖼️ win32k.sys: The Artist

What is it? Kernel-mode driver that manages the Windows GUI, window management, GDI, and mouse/keyboard input.

Forensic Role: If hooked, attackers can capture screenshots or keystrokes at a very low level, invisible to user-mode security tools.

🔑 winlogon.exe: The Key-Master

Responsibilities: Handles interactive user logon/logoff, listens for Ctrl+Alt+Del (the Secure Attention Sequence), and launches LogonUI.exe.

Forensic Tip: Multiple instances for a single session or a non-System32 directory path are high-confidence malware indicators.

📂 6. The Cast of Characters: Key Files & Handovers

Handover The "Briefcase" (Data Shared) Why it Matters
Firmware → Boot Manager UEFI System Table Rootkits can "hook" this table to hide themselves.
Boot Manager → Winload BCD Settings If security checks are OFF in the BCD, the system is at risk.
Winload → Kernel LOADER_PARAMETER_BLOCK The most critical handover. Contains the registry hive and driver list.
Kernel → SMSS.exe Handover to User Mode Transition from "Ring 0" (Kernel) to "Ring 3" (User).

📁 Key Artifact Locations — Quick Reference

Artifact Location Notes
BCD \EFI\Microsoft\Boot\BCD (on ESP) Use bcdedit to inspect
bootmgfw.efi \EFI\Microsoft\Boot\ (on ESP) The UEFI Boot Manager
winload.efi C:\Windows\System32\ Modern OS Loader
winresume.efi C:\Windows\System32\ Resume from hibernation
ntoskrnl.exe C:\Windows\System32\ The Windows Kernel
smss.exe C:\Windows\System32\ First user-mode process
winlogon.exe C:\Windows\System32\ Logon manager
boot.ini (legacy) C:\boot.ini XP and earlier only
NTLDR (legacy) C:\NTLDR XP and earlier only
NTDETECT.COM (legacy) C:\NTDETECT.COM XP and earlier only

🔍 7. Forensic Master Class: Where to Hunt?

  • ✓ The ESP Partition: Mount it and check for rogue .efi files outside of \EFI\Microsoft\Boot\.
  • ✓ The BCD: Run bcdedit /enum all and look for nointegritychecks = Yes or testsigning = Yes.
  • ✓ Secure Boot State: Check if Secure Boot is disabled via PowerShell (Confirm-SecureBootUEFI) or NVRAM dumps.
  • ✓ SMSS.exe: Check the process tree. It must be a direct child of the System process (PID 4).
  • ✓ winlogon.exe: Check for multiple instances per session or non-System32 directories.
  • ✓ Legacy Systems: Check boot.ini for unexpected ARC paths and verify NTDETECT.COM hasn't been replaced.