Windows XP Boot Components

Contents

About the Windows XP boot process

This document outlines the basic components involved in the process of booting up a PC running Windows XP, covering the initial process involved in going from power up to loading NTLDR, and then the subsequent procedure and events involved in displaying the boot menu listing available OS entries and booting into the selected item.

Generic Boot Procedure

Before we can take a detailed look at the process by which Windows XP’s boot process works, it’s important to first understand the basic principles that precede any bootloader, starting with when the PC is first powered up. You can read up on a more detailed explanation of the standard BIOS boot-up sequence here, but the following is enough to get going with:

BIOS boot chain loading MBR, bootsector, and then bootloader

 

As can be seen, there is a chain of handoffs beginning at the time you power up your PC; starting from the BIOS, continuing through to the MBR, bootsector, and then, finally, the bootloader.

There are two different reasons for this seemingly-convoluted chain. The first is for portability: you can take out and replace any one of the components powering/facilitating these four steps without needing to replace the others, as all interactions are abstracted to a set of agreed-upon behaviors — and this is especially important because each of these individual layers is traditionally manufactured, written, designed, or developed by a different entity.

The second is a more technical limitation: the amount of space available for the executable bootloader code (read: how big and complicated the bootloader is allowed to be) is severely restricted in the first stages, and increases as you go up the ladder. For example, the MBR is a mere 512 bytes (actually, only 446 bytes once you exclude the partition table!) — in comparison, this paragraph alone is twice that! The bootsector is similarly restricted in size (though the exact limits depend on the filesystem of the active partition), and it’s only after you reach the final stage of the actual bootloader file that you’re free to write lengthy boot code.

This lengthy procedure is responsible for everything up to the point that the Windows XP bootloader, NTLDR (short for NT loader) is finally located and called by the code in the bootsector of the NTFS or FAT32 boot partition.

Windows XP Boot Components

Once the boot-related code in the bootsector of the active partition is called, it will search for a file called NTLDR in its root directory (the partition itself is expected to be of NTFS or FAT32 format). NTLDR itself, while traditionally given all the praise and glory, does not do its job alone and is, at best, only a third of the solution.

NTLDR

NTLDR is the name of the bootloader used by Microsoft Windows, starting from Windows NT and continuing through Windows 2000, Windows XP, and Windows Server 2003. With the release of Windows Vista, NTLDR is no longer used and is now supplanted by BOOTMGR, the new Windows bootloader. It’s normally located in the root directory of the active partition on the first boot drive. With typically Windows XP installations, this is usually C:\ and the same partition that Windows itself is installed to, though that definitely does not have to be the case. Especially in cases where more than one OS is installed on the same computer (on different partitions), NTLDR takes heavy advantage of this feature.

BOOT.INI

Boot.ini is a plain-text file located in the root of the active partition on the first boot drive. NTLDR reads boot configuration information from the boot.ini file, and uses it to display and then boot into the various operating systems. BOOT.INI1 can contain references to Windows NT-based operating systems (Windows NT, Windows 2000, Windows XP, Windows Server 2003) as well as entries pointing to “chainloaders” (bootloaders for other operating systems saved to a file) to load non-Windows OSes. This is where new operating systems are added to the bootloader and from where the boot options/parameters of existing entries may be modified or replaced.

NTDETECT.COM

The ntdetect.com file is part of NT-based operating systems of Windows and it’s used during boot up to detect hardware components needed to start the operating system. At the startup process the NTLDR starts and ntdetect.com collects hardware information that will be sent to the ntoskrnl.exe file (Windows kernel). NTDETECT.COM is found in all NT-based operating systems: Windows XP, 2003 and Windows Vista. It collects this type of hardware information:

  • video adapters
  • hardware date and time
  • keyboards
  • hard drives
  • mouse
  • and others (bus and adapter types, floppy disks etc.)

Information and configuration collected and generated by NTDETECT are passed along to the Windows NT kernel (ntoskrnl.exe) by NTLDR when an operating system is selected. While the Windows kernel has other means of identifying and communicating with the underlying hardware on your PC (via the HAL, or hardware abstraction layer), the information from NTDETECT is crucial in facilitating first access to the disks and other hardware.

Windows XP Boot Sequence

As mentioned above, NTLDR uses both BOOT.INI and NTDETECT.COM to ultimately load a Windows installation from a local disk. The following chart summarizes the boot procedure, highlighting the interactions between the various components of the Windows XP boot system:

NTLDR uses BOOT.INI and NTDETECT.COM to show the NT boot menu and load Windows based on user selection.

NTLDR uses BOOT.INI and NTDETECT.COM to show the NT boot menu and load Windows based on user selection.

Troubleshooting XP Boot Errors

If you have boot errors related to NTDETECT or NTLDR, check other fixes available on the Wiki:

Support Links

Applicable Systems

This Windows-related knowledgebase article applies to the following operating systems:

  • Windows XP (all editions)
  • Windows Server 2003 (all editions)

Propose an edit

  1. Depending on the version of NTLDR used, boot.ini may or may not support UTF-16/UCS-2 (unicode, non-ASCII) encoding. ↩