Quick Overview: Booting Process of Windows

Booting is the process of starting a computer system. Also if you restart a computer system, you initiate a booting process. Both processes of starting or restarting Windows are called booting. On booting, the operating system resides in hard disk loading on the working memory i.e. RAM. Booting is the critical process of any OS. This blog provides a brief overview of the booting process of Windows-based systems.

Types of Booting

(1) Hard Boot or Cold Boot

Hard Boot simply means starting a computer system from the switch-off state. Generally, you start a day in your office by switching on the computer system and clicking on the power button. That is called a hard boot or cold boot.

(2) Soft Boot or Warm Boot

Soft Boot simply means re-starting a computer system from the already switch-on state. If you are working on the computer system, sometimes you restart your computer because of updates or any other reason. That restart came under the soft boot or warm boot.

Windows System Files

Windows OS needs so many files to run properly. Some are very critical as if those files are missing, Windows does not boot up. While some are not very essential, as it does not affect the operating system's running.

Generally, attackers try to corrupt system files to compromise the computer system. Hence, it is very critical to prevent OS to compromise with malicious software. Below is the list of files that are required while running OS.

File Names	Description
Win32k.sys	System file that is used for handling Windows applications
Ntdll.dll	Part of the advanced API services library
Hal.dll	Hardware Abstraction Layer Dynamic-link Library
Ntkrnlpa.exe	New Technology Kernel Process Allocator
Ntoskrnl.exe	for memory management and hardware abstraction
User32.dll	Help in manipulating the user interface
Advapi32.dll	Part of advanced API services library
Kernel32.dll	Part of the advanced API services library
Gdi32.dll	help in operating Windows programs

Windows Boot Process

Windows 8 and above operating system uses the BIOS-MBR method or UEFI-GPT method. Please remember that the UEFI-GPT method is the newer method and the selection of the method depends on the choice of the user. BIOS-MBR method is also used by old Windows operating systems such as Windows XP, Vista, and Windows 7.

BIOS-MBR

1. The first step is to load the BIOS by hitting the power button. BIOS will check prerequisites such as whether the hardware is connected, and in a running state.
2. MBR starts.
3. The Volume Boot Sector (VBS) takes care of the operating system.
4. NT Boot Sector starts.
5. BOOTMGR.EXE starts. It checks Boot Configuration Data (BCD) and WINRESUME.EXE
6. WINLOAD.EXE starts loading the operating system kernel.
7. NTOSKRNL.EXE initiates to check HAL.DLL.
8. Phase 0 starts with NTOSKRNL.EXE.
9. Phase 1 starts with NTOSKRNL.EXE.
10. SMSS.EXE starts.
11. WINLOGON.EXE
12. LSASS.EXE

To check which boot method is used by your desktop, follow the below navigation

1. Open "Computer Management" with Administrator privilege
2. Click on Disk Management
3. Right-click on Disk 0 and select properties