Chapter 3 - Disk Management Basics

This chapter is about managing and understanding disks. Its purpose is to provide you with a basic understanding of disk hardware and how Windows NT accesses the disks. It also describes the Windows NT startup process, so you know what is happening when you power on your computer. We want you to be able to effectively troubleshoot disk and startup problems.

On This Page

Why You Should Know About Disks
About Disks and Disk Organization
Disk Sectors Critical to the Startup Process
What Happens When You Start Your Computer
Contents and Purpose of Boot.ini (x86-based Computers)
Using Hard Disks With More Than 1024 Cylinders (x86-based Computers)
Using Removable Disks and Floppy Disks
Windows NT File Systems

Why You Should Know About Disks

Disk problems are frequently the cause of startup failures. Some of these problems are the result of hardware errors. But frequently the problem is that Windows NT is unable to find the information about the disk or its contents, usually because of control information corruption. If you know what the control information on your disk should be, you can tell if it has been corrupted.

There are several reasons that Windows NT cannot give your computer complete protection:

• The security provided by Windows NT is effective only when the operating system is running. If you are running another operating system, or if an unauthorized person can walk up to the computer and restart it, Windows NT cannot provide any protection.

• External media devices, such as floppy disks and CD-ROMs, provide the physical means for anyone to bypass Windows NT and gain access to your files. You can also introduce viruses from floppy disks or from files that you copy or download from other computers.

• The transaction logging that the Windows NT file system (NTFS) does for recoverability purposes protects only NTFS metadata.

• A power failure can cause corruption. So can turning off your computer without going through shutdown.

This following list highlights simple procedures that you can implement to reduce the potential for problems and make it easier for you to recover when problems occur.

• First, implement physical security. Put your computers in a secure room. Lock them. Use a password on your screen saver. Run virus checks on your computer and on floppy disks before you use them. Or disable the floppy disk, which is supported in some system BIOSs. If you cannot disable the floppy disk in the BIOS, you can physically disconnect it.

• Develop a preventive maintenance plan and schedule regular maintenance. You might not know about file system problems until you restart your computer, when the Chkdsk program tells you that there are errors or that a volume is Unknown.

• Back up data that are critical to the operation of the computer when you make changes to them. These data include the Registry, Master Boot Record, and Partition Boot Sectors. You also need a way to start another installation of Windows NT Server if the one you normally use doesn't work, either because hardware failure or corruption makes the primary installation unusable.

• Know the configuration of the computer. If you have more than one disk with more than one partition, you need to know which data are on which partitions on which disks. For example, which partition is your system partition or your boot partition? If you have implemented volume sets, stripe sets, mirror sets, or stripe sets with parity, which disks are members of which sets?

• Implement a backup procedure for user data. Users will delete files or make changes to them and then want the old version back. Files can get corrupted when applications crash. A power failure can adversely affect files and disks in many ways. You need to be able to restore individual files, as well as a complete disk's worth of data, or even all of the files on the computer.

This chapter, and the other chapters in the "Reliability and Recoverability" part of this book, provide much more detailed information about the preceding topics. There are more details about disk organization, file systems, and starting your computer in the following chapters of the Windows NT Workstation Resource Guide:

• Chapter 17, "Disk and File System Basics."

• Chapter 18, "Choosing a File System."

• Chapter 19, "What Happens When You Start Your Computer."

About Disks and Disk Organization

This section describes the physical structure of hard disks and floppy disks, and presents an overview of ways to logically organize areas on your disks.

Both hard disks and floppy disks work similar to an old-fashioned record player, with the record turning on the turntable and a needle playing the music. They are also similar to VCRs and stereo cassettes in that disks, cassette players, and VCRs all use a read/write head to access the information that is stored on the magnetic media.

Hard or fixed disks store information on a revolving platter of metal or glass coated with a magnetic material. The disk typically consists of several physical platters on a common spindle. This platter is similar to the record on a record player, except information is usually stored on both sides of a disk platter.

As the disk rotates, a transducer element called the head reads or writes binary data on the magnetic media. There are many methods for encoding data on the disk, such as modified frequency modulation (MFM) and run length limited (RLL). The disk controller logic determines the method used and the density of data on the disk.

Note: There are some state-of-the-art disks and disk controllers that have different hardware and logic than are described in this chapter.

Hardware Terminology

Each disk consists of platters, rings on each side of each platter called tracks, and sections within each track called sectors. A sector is the smallest physical storage unit on a disk, almost always 512 bytes in size.

Figure 3.1 illustrates a hard disk with two platters. The remainder of this section describes the terms used on the figure.

The cylinder/head/sector notation scheme described in this section is slowly being eliminated. All new disks use some kind of translation factor to make their actual hardware layout appear as something else, mostly to work with MS-DOS and Windows 95. See the section titled "Translation," presented later in this chapter, for more information.

Tracks and Cylinders

On hard disks, the data are stored on the disk in thin, concentric bands called tracks. There can be more than a thousand tracks on a 3½ inch hard disk. Tracks are a logical rather than physical structure, and are established when the disk is low-level formatted. Track numbers start at 0, and track 0 is the outermost track of the disk. The highest numbered track is next to the spindle. If the disk geometry is being translated, the highest numbered track would typically be 1023. Figure 3.2 shows track 0, a track in the middle of the disk, and track 1023.

A cylinder consists of the set of tracks that are at the same head position on the disk. In Figure 3.2, cylinder 0 is the four tracks at the outermost edge of the sides of the platters. If the disk has 1024 cylinders (which would be numbered 0-1023), cylinder 1023 consists of all of the tracks at the innermost edge of each side.

Heads and Sides

A head is a small transducer that can be positioned over a disk track by using a solenoid or servomotor. The head can change the properties of the magnetic media as it rotates underneath.

There is one head for each side of each platter. The heads are normally attached to a common head-movement mechanism, so that the heads all move in unison. The heads are always positioned at the same logical track on each side of each platter.

Because disk tracks are concentric bands, the heads must move to the track that contains the data to be accessed. The moving of the heads from the current track to the track that contains the next data is called seeking. The heads are moved over the surface of the disk in small increments called steps. Each step corresponds to one track.

Sectors and Clusters

Each track is divided into sections called sectors, and each track on the disk has the same number of sectors. A sector is the smallest physical storage unit on the disk. The data size of a sector is always a power of two, and is almost always 512 bytes.

The Windows NT file systems allocate storage in clusters, where a cluster is one or more contiguous sectors. Windows NT bases the cluster size on the size of the volume.

As a file is written to the disk, the file system allocates the appropriate number of clusters to store the file's data. For example, if each cluster is 512 bytes and the file is 800 bytes, two clusters are allocated for the file. Later, if you update the file to, for example, twice its size (1600 bytes), another two clusters are allocated.

If contiguous clusters (clusters that are next to each other on the disk) are not available, the data are written elsewhere on the disk, and the file is considered to be fragmented. Fragmentation is a problem when the file system must search several different locations to find all the pieces of the file you want to read. The search causes a delay before the file is retrieved. A larger cluster size reduces the potential for fragmentation, but increases the likelihood that clusters will have unused space.

Using clusters larger than one sector reduces fragmentation, and reduces the amount of disk space needed to store the information about the used and unused areas on the disk. Because the FAT file system can use only 16 bits for the cluster number, using clusters enables FAT volumes to be larger than 65,535 sectors. There is more information about the FAT file system and FAT volumes presented later in this chapter.

Figure 3.3 shows a sector and a grouping of four contiguous sectors into a cluster.

Translation

Translation is the conversion of physical disk geometry (the number of cylinders on the disk, number of heads per cylinder, and number of sectors per track) to a logical configuration that is compatible with the operating system.

Many state-of-the-art disks now have a feature called Translation Mode. The disk queries the system BIOS (x86-based computers) or firmware (RISC-based computers) to determine the logical parameters the computer needs. If the number of cylinders, heads, and sectors per track the computer needs is within the range supported by the disk, the disk automatically configures itself to match those parameters. If the system BIOS or firmware does not support translation, the disk configures itself to its largest possible size, which is typically around 500 MB.

For example, all SCSI disks use some kind of translation, and many SCSI disks support hot swapping of sectors to fix bad sectors. This means that a SCSI disk maintains a set of unused sectors at the end of a disk. When a used sector goes bad, it is remapped to an unused sector and the data are written to the new sector. Windows NT uses absolute sector notation (also called logical sector notation, or LSN) for accessing disks. The translation of the sector number to the physical sector on the disk is handled by low-level disk device drivers and the hardware.

The translation is especially important when there are more than 1024 physical cylinders on the disk. The section titled "Using Hard Disks With More Than 1024 Cylinders (x86-based Computers)," presented later in this chapter, contains more details. There is also more information in Chapter 5, "Preparing for and Performing Recovery."

Logical Organization: Partitions and Volumes

The Master Boot Record on each hard disk contains an area called the Partition Table that the computer uses to determine how to access the disk. It has room for four entries, called partitions, that you create to make it easier to organize information. A partition must be completely contained on one physical disk.

Use Disk Administrator to create and format partitions. The next figure is a Disk Administrator screen shot for a computer with a single disk.

Disk Administrator shows you the layout of each of your disks, including:

• The size of each disk.

• The size, label, and file system used for each partition on the disk.

• The size and location of free space.

The remainder of this section describes partitions, and explains what you see in the Figure 3.4.

There are two types of partitions in the Master Boot Record, primary and extended. A primary partition is one into which you can install the files needed to load an operating system. A primary partition is formatted for a particular file system and is assigned a drive letter. Having multiple primary partitions enables you to install and start operating systems that do not use the same file system, such as Windows NT and UNIX. There are three primary partitions in Figure 3.4, C, D, and L.

You can have one extended partition on a hard disk. An extended partition is effectively a logical disk. Unlike a primary partition, you do not format the extended partition, nor does it get assigned a drive letter. Instead, you can create one or more logical drives within the extended partition, and each logical drive is assigned a drive letter. You format each logical drive for a particular file system.

An extended partition is a method for avoiding the four-partition limit and configuring a hard disk into more than four logical areas. An extended partition entry looks much like a primary partition entry in the Master Boot Record, except that it points to space on the disk that can contain one or more logical drives. The important information about an extended partition is how much of the disk it takes up and where it starts.

Note: In this chapter, and other chapters in the "Reliability and Recoverability" part of this book, the term logical drive means a contiguous area in an extended partition, which is assigned a drive letter.

There is an extended partition in Figure 3.4, but it is not as easy to identify as the primary partitions. The extended partition consists of all the disk area between primary partitions D and L. If there are logical drives on a disk, then you have an extended partition on that disk. If you have free space for which the diagonal lines look like the ones for the 4 MB of free space to the left of primary partition L, then you have an extended partition on the disk.

Figure 3.4 shows an important point. The unpartitioned space at the end of the disk (to the right of primary partition L) cannot be used. You can have only three primary partitions and one extended partition on a hard disk, or four primary partitions. This disk already has the maximum for each of these types.

Note: The distinction between the two areas of free space is that the one to the left of L is free space within an extended partition, while the free space on the right of L, which has a different background pattern, is not a part of any partition.

If you have more than one primary partition or logical drive on a disk, you can format them for different file systems. However, the format program will use the same sector size, number of tracks per cylinder, and number of sectors per track for each partition or logical drive. The cluster size can be different for each one.

The system partition is the partition on a disk that contains the hardware-specific files used in loading and initializing the operating system. Only a primary partition can be used as a system partition. Some programs, such as Disk Administrator and the MS-DOS-based program Fdisk, use the term active partition to refer to the same thing. This book uses the term system partition unless it is specifically describing dialog boxes or menus that use the term active or active partition.

The boot partition is also used in starting the operating system. It contains the operating system files and other support files needed by the operating system. Both a primary partition and a logical drive in an extended partition can be used as a boot partition. The system partition and the boot partition can be the same partition, or they can even be on different disks. There is more information about the system and boot partitions presented later in this chapter and in other chapters in "Reliability and Recoverability" part of the Windows NT Server Resource Guide.

Note: To summarize, you can have as many as four primary partitions on a hard disk. If you have an extended partition on the disk, you can have up to three primary partitions. If the disk does not contain the system partition, you do not need to create any primary partitions. You can use the entire hard disk as an extended partition, and create as many logical drives within it as you want to have.

Windows NT requires that the system partition be a primary partition.

Some computers create an EISA configuration partition as the first primary partition on the hard disk. On these computers, you can only have three other primary partitions on the disk, or two primary partitions and one extended partition.

You create a volume set by combining multiple areas of free space on one or more hard disks into a single logical disk. When you create a volume set, Windows NT uses the HKEY_LOCAL_MACHINE \SYSTEM \DISK Registry subkey to access the areas on the disk(s) that are part of the volume set.

A volume set can be made from:

• Free space on multiple disks.

• Multiple areas of free space on one disk.

• Multiple areas of free space on multiple disks.

You use Disk Administrator to create and extend volume sets. See Disk Administrator Help for information about creating volume sets.

Each volume set can include up to 32 areas of free space from one or more physical disks. When creating a volume set, the free space can be an unallocated area within an extended partition, or an unpartitioned area elsewhere on the disk. Figure 3.4 shows a volume set E, which is made up of two areas in the extended partition on disk 0. Figure 3.4 also shows the two different types of free space. The free space between drives E and L is unallocated space in an extended partition. The free space at the right side of the screen shot is unpartitioned space.

You cannot use volume sets to avoid the limit of four Partition Table entries for a disk. For example, the Disk Administrator screen shot in Figure 3.4 shows three primary partitions (drives C, D, and L) and one extended partition. The free space between the second part of volume set E and the primary partition L is part of the extended partition. It can be used to create one or more logical drives in the extended partition. However, the free space to the right of primary partition L is wasted disk space, because there are already three primary partitions and an extended partition.

You can tell whether free space is unallocated space in an extended partition or is unpartitioned space, because the diagonal lines go in different directions for the two types of free space.

A stripe set, a mirror set, and a stripe set with parity are each composed of identically sized areas on multiple disks. Like volume sets, Windows NT must use the HKEY_LOCAL_MACHINE \SYSTEM \DISK Registry subkey to know how to access the disks. You use Disk Administrator to create these types of volumes. For a description of stripe sets, mirror sets, and stripe sets with parity, see Chapter 4, "Planning a Reliable Configuration." For information about creating and using mirror sets and stripe sets with parity, see Chapter 5, "Preparing for and Performing Recovery."

Volume is the general term that refers to all of the following entities that you can create and use on a computer running Windows NT Server.

• Primary partition.

• Logical drive in an extended partition.

• Volume set.

• Stripe set.

• Mirror set.

• Stripe set with parity.

A volume has a single drive letter assigned to it, and is formatted for use by a file system.

See the section titled "Maximum Sizes," presented later in this chapter, for information about the maximum size of volumes.

Which Programs to Use to Create and Format Volumes

This section provides information about how to create and format volumes. You can create and format a volume in one of the following ways:

• During Windows NT Setup, you can:

  • Create and format a new primary partition into which to install Windows NT, provided you have enough unpartitioned disk space for the Windows NT installation (approximately 160 MB for Windows NT Server on a RISC-based computer).

  • Format an existing, unformatted volume into which to install Windows NT.

  • When you choose to install Windows NT in an existing FAT volume, you can convert the volume from the FAT file system to the NTFS file system. Converting preserves the data on the volume.

• If you have Windows NT installed on your computer, you can use Disk Administrator to create and format the volume. You can also use Disk Administrator to reformat an existing volume that is already formatted for the FAT file system or the NTFS file system. Reformatting a volume erases all information about which files used to be on the volume. You can reformat the volume as FAT or NTFS, regardless of what file system it is currently formatted for. For information about Disk Administrator procedures, see the Disk Administrator Help.

• If you want to specify special options during the format, such as a cluster size to use for a FAT volume, you can run the Format program from the command prompt. To see the options for the Format program, enter format /? at the command prompt.

• When running Windows NT, you can use the Convert program to convert an existing FAT volume to an NTFS volume, which preserves the data on the volume. For information about using the Convert program, see Chapter 7, "Disk, File System, and Backup Utilities."

• When you have started MS-DOS, you can use the fdisk command to create a primary partition or logical drive, and use the format command to format the volume for the FAT file system. See MS-DOS Help for information about these commands.

• On Alpha AXP-based computers and MIPS-based computers, you can use the Arcinst program to create and format volumes.

Note: Converting a volume from the FAT file system to the NTFS file system can take a long time, depending on the amount of fragmentation and size of the FAT volume. For example, converting a 1 GB volume can take up to several hours. The conversion process has to read all of the files to build the information that NTFS needs to have about the data on the volume. When using the Convert program or converting the volume in Windows NT Setup, no status information is displayed to indicate that the conversion is proceeding. Although it looks like the conversion process is hung, it might just be taking a long time. For a large volume, it might be a good idea to run the file system conversion process overnight.

It might be faster to back up the data on the FAT volume to tape or a remote computer, reformat the volume as NTFS, and then restore the data.

If you create a single primary partition that occupies the entire disk, you cannot change the way your disk is organized without deleting the primary partition (which deletes all of the information in it) and creating new, smaller primary partitions or an extended partition. You have to back up the information that you need to save to a backup tape or a disk on a remote computer, reinstall Windows NT, and restore the data to the new volumes that you have created.

If there is no unpartitioned space left on your disk, the Create and Create Extended options on the Disk Administrator Partition menu are not available.

When you use Disk Administrator to create volumes, you have to write the changes to the Partition Table before you can format the volume. You know that you need to write the changes if the Format command is not available (grayed) on the Tools menu. You can write the changes by using one of these methods:

• Clicking Commit Changes Now on the Partition menu. You can now click the volume, click the Tools menu, and click Format.

• Exiting Disk Administrator. If you have made changes to your disk configuration, Disk Administrator displays a dialog box that asks whether you want to save changes. Click Yes. You can now restart Disk Administrator, click the volume, click the Tools menu, and click Format.

If you have created a volume but not formatted it, Disk Administrator displays the volume as unformatted. You cannot access the volume in either My Computer or Windows NT Explorer until it has been formatted.

You cannot see an NTFS volume when you are running any operating system other than Windows NT. This means that your drive letters will probably be different when you are running Windows NT and other operating systems. For example, if you have two FAT volumes (C and E), and an NTFS volume (D), and you start the MS-DOS operating system, the second FAT volume will be labeled D. Because MS-DOS does not recognize the NTFS volume, the drive letter that was assigned to the NTFS volume when running Windows NT is used for the second FAT volume when running MS-DOS.

In Disk Administrator, you cannot delete the Windows NT boot partition when you are running Windows NT. You can delete the Windows NT boot partition if it is not the same partition as the system partition and you start another operating system that does not use the Windows NT boot partition as its boot partition.

Formatting Hard Disks and Floppy Disks

Before you can use a hard disk or a floppy disk, you must format the disk.

There are three steps involved in formatting a hard disk:

• Low-level formatting the disk.

• Creating primary partitions or logical drives in an extended partition.

• Doing a logical formatting of the primary partitions or logical drives.

Formatting a floppy disk is much simpler than formatting a hard disk, because there are fewer steps. You cannot create partitions on a floppy disk, so there are only two steps:

• Low-level formatting the disk.

• Doing a logical formatting of the disk.

When you format a floppy disk, the format program performs both a low-level format and a logical format, so there is really only one step. However, the low-level format on a floppy disk is not as thorough as on a hard disk.

The rest of this section discusses low-level formatting, creating partitions, and logical formatting.

Low-level Formatting

Each disk vendor provides the low-level format program to use for the disk. Consult your disk documentation or contact the vendor to find out how to do low-level formatting.

Each low-level format program determines the correct sector size to use, the number of tracks, and the number of sectors per track. This format program selects sector size based upon the disk and the information about the sectors in its circuitry. The program for almost all disks used in the United States uses a sector size of 512 bytes. The program also writes error correction and sector identification information for each sector onto the disk.

SCSI disks should always be low-level formatted when put on a new controller. The reason for this is that the translation in use on the disk varies from controller to controller, and can even vary between two identical controllers based upon the controller settings.

On x86-based computers, you must enable the BIOS on the SCSI controller if your system partition is on a SCSI disk. Depending upon your disk configuration, you might need to turn off translation in the SCSI controller. Also make sure that the CMOS has no entries for SCSI disks. For more information about the SCSI controller, see Chapter 5, "Preparing for and Performing Recovery."

There are some older IDE disks that you should not low-level format, because the factory formatting puts information on the disk that a low-level format erases. However, newer IDE disks, and all enhanced IDE disks (also known as EIDE) need to be low-level formatted. You must configure an IDE or EIDE disk in the CMOS before you can use it on the computer. See your hardware documentation for information about changing information in the CMOS.

If you have created and formatted volumes on your hard disk, but are getting errors from the Chkdsk program or other disk scan utilities about bad sectors on your disk, the only way to permanently eliminate them is to do a low-level format. Low-level formatting maps around the bad sectors. However, a low-level format erases all data on the disk. Therefore, be sure to back up any data on the disk before you low-level format it. You then need to create volumes (primary partitions or logical drives in an extended partition), and logically format them before you can restore the data to the disk.

Caution: Do not low-level format IDE hard disks unless the manufacturer's literature describes that you should do so.

Creating Partitions on the Disk

When you create primary partitions or an extended partition on a disk, you logically divide it into one or more areas that can be formatted for use by a file system. The first partition on the disk (whether it is a primary partition or an extended partition) always starts at the outside of the disk, at cylinder 0, head 0, and sector 1. Because partition boundaries are always cylinder boundaries, the smallest partition that you can create on a disk consists of all of the tracks on a single cylinder.

When you have Windows NT installed on your computer, you should use Disk Administrator to create partitions. However, if you are setting up a new computer, you might not have any operating system installed. But you still need to create and format a partition into which to install Windows NT.

On x86-based computers, if you have an MS-DOS bootable floppy disk with the Fdisk program on it, you can start your computer from the MS-DOS floppy disk and create partitions by using Fdisk. On RISC-based computers, you can use the Arcinst program on the Windows NT Server CD to create partitions. Windows NT Setup displays an option to create a partition to use for Windows NT, provided that there is enough unpartitioned space on a hard disk.

Note: On x86-based computers, you might not be able to access all your hard disk when using fdisk. If you have a disk that is larger than 4 gigabytes (GB), MS-DOS cannot see the space beyond 4 GB. Depending on the geometry, this limitation could even be 1 GB, because MS-DOS cannot access volumes that go beyond cylinder 1023. If you have more than 2 SCSI disks, MS-DOS generally does not see any disks after the first two, unless you load a SCSI device driver.

When you create the first partition on a disk (either a primary partition or an extended partition), the program that you use creates the Master Boot Record and writes it to the first sector on the disk (cylinder 0, head 0, sector 1). The Master Boot Record contains the Partition Table, which has information about each partition defined on the disk. When you make any changes to volumes on the disk, such as creating, deleting, or formatting them, the program that you are using updates the Partition Table.

You can configure the entire disk as one primary partition, and logically format it for one file system. Or you can create more than one primary partition, and use different file systems on them. You can also create an extended partition, and create one or more logical drives within the extended partition.

For more information about primary partitions, logical drives, and extended partitions, see "Logical Organization: Partitions and Volumes," presented earlier in this chapter. For more information about the Master Boot Record and Partition Table, see "Disk Sectors Critical to the Startup Process," presented later in this chapter.

Logical Formatting

Before you can write any data to a primary partition or logical drive, you must do a logical format; that is, format it for use by a file system. Logical formatting writes information needed by the file system onto the disk. The information includes:

• Partition Boot Sector.

• Changing the System ID field in the Partition Table (hard disk only).

• File system metadata, including information about available and unused space and location of files and folders.

• Damaged areas.

When you have Windows NT installed on your computer, you should use Disk Administrator to format the volumes.

On x86-based computers, you can format primary partitions and logical drives for the FAT file system before you install any operating systems by starting the computer from a MS-DOS bootable floppy disk that has the Format program on it. You can use the Format program only for volumes that do not go beyond cylinder 1023.

On Alpha-based computers and MIPS-based computers, you can run the Arcinst program from the Windows NT Server product CD to format partitions on the hard disk.

On both x86-based computers and RISC-based computers, you can create and format a primary partition to use for Windows NT during Setup, provided that there is enough unpartitioned space on a hard disk.

Why Do You Need to Know Your Disk Configuration?

The next Disk Administrator screen shot is used to help you to understand the importance of knowing how the primary partitions and logical drives on your disks relate to each other, and why it is best if you can keep your disk configuration simple.

Note: The key at the bottom of the Disk Administrator screen identifies the types of volumes that are configured on the computer. In the preceding screen shot, there are no stripe sets, mirror sets, or stripe sets with parity configured on the computer. Therefore, you do not see those types of volumes in the screen shot.

All that you can tell by looking at this screen shot is how the disks are configured and which volumes have been created. When using Disk Administrator, you cannot tell what a volume contains, or the order in which the members of a volume set, stripe set, or stripe set with parity were combined to form the volume.

To create a volume set, stripe set, or stripe set with parity

1. Click an unpartitioned area on one of the disks.

2. Holding the CTRL key, click each of the other unpartitioned areas that you want to combine into the volume.

3. For a volume set or stripe set, click Create Volume Set or Create Stripe Set on the Partition menu. For a stripe set with parity, click Create Stripe Set With Parity on the Fault Tolerance menu.

The order in which you combined the areas on the disks into volume sets, stripe sets, or stripe sets with parity is critical information. It does not matter whether you first create a volume set, and then a stripe set, or the other way around. But it is absolutely critical to know in what order unpartitioned areas were added to a volume set that has been repeatedly extended.

It does not matter in what order you clicked the unpartitioned areas. What does make a difference is the order in which the disks were listed on the Disk Administrator screen when you selected them, and whether that order ever changes (for example, because you changed SCSI IDs). For example, the Disk Administrator screen shot at the beginning of this section has an IDE disk (disk 0) and a SCSI disk (disk 1). If you added a new SCSI disk between these two disks, and changed the SCSI ID of the current disk, you would not be able to access the volume sets on the disk that is currently disk 1.

The information that Windows NT uses to know how to access each of these volumes is in the HKEY_LOCAL_MACHINE \SYSTEM \DISK Registry subkey. The index to that Registry subkey is provided by a four-byte disk signature that is in the first sector of each hard disk. If this disk signature is ever changed, either because you replaced the disk, through corruption, or because someone modified it by using a low-level disk editor, you lose access to the volumes. You need to know the order in which the members of the volume were selected if you ever need to reconstruct the volume by using the FtEdit program (described in Chapter 7, "Disk, File System, and Backup Utilities").

To make matters even more complex, disks have different geometries. The geometry is the number of sectors per track, number of heads (or sides) on the disk, and the total number of cylinders on the disk.

The disk geometry is most important when you are configuring fault-tolerant volumes (mirror sets and stripe sets with parity). Having identical disk geometry is critical when you are configuring your system partition as a mirror set. For the most recoverable configuration, you should have identical primary partitions on both disks of the mirror set. Having different geometries means that you will never be able to start from your shadow disk without using the Windows NT startup floppy disk. Different geometries on the original and shadow system partition also mean that you can never start from your original system partition without using the Windows NT startup floppy disk when you have had to rebuild the disk (due to hardware failure or corruption). For details about mirroring the system partition, see the section titled "Configuring the System Partition on a Mirror Set," in Chapter 5, "Preparing for and Performing Recovery."

Now you have background information about why you need to know your disk configuration, and have an appreciation for the value of a simple configuration.

Disk Sectors Critical to the Startup Process

There are two sectors on the disk that are critical to starting the computer:

• Master Boot Record.

• Partition Boot Sector.

These sectors contain both executable code and the data required by the code. For more information about the startup process, see "What Happens When You Start Your Computer," presented later in this chapter. For a description of problems that you might encounter with these two sectors, see Chapter 6, "Troubleshooting Startup and Disk Problems."

Note: Numbers larger than one byte are stored on x86-based computers in little endian format. For example, the sample value for the Relative Sector field in Table 3.1, 0x3F000000, is a little endian representation of 0x0000003F. The decimal equivalent of this little endian number is 63. Because most problems with the Master Boot Record and Partition Boot Sector occur on x86-based computers, the examples of these disk sectors are hexidecimal dumps from x86-based computers.

Master Boot Record

The Master Boot Record, created when you create the first partition on the hard disk, is probably the most important data structure on the disk. It is the first sector on the disk. The location is always track (cylinder) 0, head (side) 0, and sector 1.

The Master Boot Record contains the Partition Table for the disk and a small amount of executable code. On x86-based computers, the executable code examines the Partition Table, and identifies the system partition. The Master Boot Record then finds the system partition's starting location on the disk, and loads an copy of its Partition Boot Sector into memory. The Master Boot Record then transfers execution to executable code in the Partition Boot Sector.

Note: Although there is a Master Boot Record on every hard disk, the executable code in the sector is used only if the disk is connected to an x86-based computer and the disk contains the system partition.

Figure 3.5 shows a hex dump of the sector containing the Master Boot Record. The figure shows the sector in two parts. The first part is the Master Boot Record, which occupies the first 446 bytes of the sector. The disk signature (FD 4E F2 14) is at the end of the Master Boot Record code. The second part is the Partition Table.

Physical Sector: Cyl 0, Side 0, Sector 1     
00000000: 00 33 C0 8E D0 BC 00 7C  - 8B F4 50 07 50 1F FB FC   .3.....|..P.P..
00000010: BF 00 06 B9 00 01 F2 A5  - EA 1D 06 00 00 BE BE 07   ................
00000020: B3 04 80 3C 80 74 0E 80  - 3C 00 75 1C 83 C6 10 FE   ...<.t..<.u.....
00000030: CB 75 EF CD 18 8B 14 8B  - 4C 02 8B EE 83 C6 10 FE   .u......L.......
00000040: CB 74 1A 80 3C 00 74 F4  - BE 8B 06 AC 3C 00 74 0B   .t..<.t.....<.t.
00000050: 56 BB 07 00 B4 0E CD 10  - 5E EB F0 EB FE BF 05 00   V.......^.......
00000060: BB 00 7C B8 01 02 57 CD  - 13 5F 73 0C 33 C0 CD 13   ..|...W.._s.3...
00000070: 4F 75 ED BE A3 06 EB D3  - BE C2 06 BF FE 7D 81 3D   Ou...........}.=
00000080: 55 AA 75 C7 8B F5 EA 00  - 7C 00 00 49 6E 76 61 6C   U.u.....|..Inval
00000090: 69 64 20 70 61 72 74 69  - 74 69 6F 6E 20 74 61 62   id partition tab
000000A0: 6C 65 00 45 72 72 6F 72  - 20 6C 6F 61 64 69 6E 67   le.Error loading
000000B0: 20 6F 70 65 72 61 74 69  - 6E 67 20 73 79 73 74 65    operating syste
000000C0: 6D 00 4D 69 73 73 69 6E  - 67 20 6F 70 65 72 61 74   m.Missing operat
000000D0: 69 6E 67 20 73 79 73 74  - 65 6D 00 00 80 45 14 15   ing system...E..
000000E0: 00 00 00 00 00 00 00 00  - 00 00 00 00 00 00 00 00   ................
000000F0: 00 00 00 00 00 00 00 00  - 00 00 00 00 00 00 00 00   ................
00000100: 00 00 00 00 00 00 00 00  - 00 00 00 00 00 00 00 00   ................
00000110: 00 00 00 00 00 00 00 00  - 00 00 00 00 00 00 00 00   ................
00000120: 00 00 00 00 00 00 00 00  - 00 00 00 00 00 00 00 00   ................
00000130: 00 00 00 00 00 00 00 00  - 00 00 00 00 00 00 00 00   ................
00000140: 00 00 00 00 00 00 00 00  - 00 00 00 00 00 00 00 00   ................
00000150: 00 00 00 00 00 00 00 00  - 00 00 00 00 00 00 00 00   ................
00000160: 00 00 00 00 00 00 00 00  - 00 00 00 00 00 00 00 00   ................
00000170: 00 00 00 00 00 00 00 00  - 00 00 00 00 00 00 00 00   ................
00000180: 00 00 00 00 00 00 00 00  - 00 00 00 00 00 00 00 00   ................
00000190: 00 00 00 00 00 00 00 00  - 00 00 00 00 00 00 00 00   ................
000001A0: 00 00 00 00 00 00 00 00  - 00 00 00 00 00 00 00 00   ................
000001B0: 00 00 00 00 00 00 00 00  - FD 4E F2 14 00 00         .........N....

80 01                 ..
000001C0: 01 00 06 0F 7F 96 3F 00  - 00 00 51 42 06 00 00 00   .....?...QB....
000001D0: 41 97 07 0F FF 2C 90 42  - 06 00 A0 3E 06 00 00 00   A....,.B...>....
000001E0: C1 2D 05 0F FF 92 30 81  - 0C 00 A0 91 01 00 00 00   .-....0.........
000001F0: C1 93 01 0F FF A6 D0 12  - 0E 00 C0 4E 00 00 55 AA   ...........N..U.

Figure 3.5. Hex Dump of the Master Boot Record for an x86-based computer

The disk signature is a unique number at offset 0x1B8 that Windows NT uses as an index to store and retrieve information about the disk in the Registry subkey HKEY_LOCAL_MACHINE \SYSTEM \DISK. The first time that you open Disk Administrator after formatting a hard disk, it displays a dialog box that informs the user that no disk signature was found on the disk. You should select Yes, or Windows NT will not be able to access the disk.

Many destructive viruses can damage the Master Boot Record and make it impossible to start the computer from the hard disk. Because the code in the Master Boot Record executes before any operating system is started, no operating system can detect or recover from corruption of the Master Boot Record. You can use the DiskProbe program on Windows NT Server Resource Kit CD to display the Master Boot Record, and compare it to the Master Boot Record shown in Figure 3.5. There are also utilities on the Resource Kit that enable you to save and restore the Master Boot Record. See Chapter 6, "Troubleshooting Disk and Startup Problems," and Chapter 7, "Disk, File System, and Backup Utilities," for more information.

Partition Table

The information about primary partitions and an extended partition is contained in the Partition Table, a 64-byte data structure located in the same sector as the Master Boot Record (cylinder 0, head 0, sector 1). The Partition Table conforms to a standard layout that is independent of the operating system. Each Partition Table entry is 16 bytes long, making a maximum of four entries available. Each entry starts at a predetermined offset from the beginning of the sector, as follows:

• Partition 1 0x01BE (446)

• Partition 2 0x01CE (462)

• Partition 3 0x01DE (478)

• Partition 4 0x01EE (494)

The last two bytes in the sector are a signature word for the sector and are always 0x55AA.

The next figure is a printout of the Partition Table for the disk shown in Figure 3.4. When there are fewer than four partitions, the remaining fields are all zeros.

80 01                 ..
000001C0: 01 00 06 0F 7F 96 3F 00  - 00 00 51 42 06 00 00 00   .....?...QB....
000001D0: 41 97 07 0F FF 2C 90 42  - 06 00 A0 3E 06 00 00 00   A....,.B...>....
000001E0: C1 2D 05 0F FF 92 30 81  - 0C 00 A0 91 01 00 00 00   .-....0.........
000001F0: C1 93 01 0F FF A6 D0 12  - 0E 00 C0 4E 00 00 55 AA   ...........N..U.

Figure 3.6. Partition Table from an x86-based computer

The following table describes each entry in the Partition Table. The sample values correspond to the information for partition 1 in Figure 3.6.

Table 3.1 Partition Table Fields

Byte Offset	Field Length	Sample Value	Meaning
00	BYTE	0x80	Boot Indicator. Indicates whether the partition is the system partition. Legal values are: 00 = Do not use for booting. 80 = System partition.
01	BYTE	0x01	Starting Head.
02	6 bits	0x01	Starting Sector. Only bits 0-5 are used. Bits 6-7 are the upper two bits for the starting cylinder field.
03	10 bits	0x00	Starting Cylinder. This field contains the lower 8 bits of the cylinder value. Starting cylinder is thus a 10-bit number, with a maximum value of 1023.
04	BYTE	0x06	System ID. This byte defines the volume type. In Windows NT, it also indicates that a partition is part of a volume that requires the use of the HKEY_LOCAL_MACHINE \SYSTEM \DISK Registry subkey.
05	BYTE	0x0F	Ending Head.
06	6 bits	0x3F	Ending Sector. Only bits 0-5 are used. Bits 6-7 are the upper two bits for the ending cylinder field.
07	10 bits	0x196	Ending Cylinder. This field contains the lower 8 bits of the cylinder value. Ending cylinder is thus a 10-bit number, with a maximum value of 1023.
08	DWORD	3F 00 00 00	Relative Sector.
12	DWORD	51 42 06 00	Total Sectors.

The remainder of this section describes the uses of these fields. Definitions of the fields in the Partition Table is the same for primary partitions, extended partitions, and logical drives in extended partitions.

Boot Indicator Field

The Boot Indicator field indicates whether the volume is the system partition. On x86-based computers, only one partition on the disk should have this field set. This field is used only on x86-based computers. On RISC-based computers, the nonvolatile RAM (NVRAM) contains the information for finding the files to load.

System ID Field

For primary partitions and logical drives, the System ID field describes the file system used to format the volume. Windows NT uses this field to determine what file system device drivers to load during startup. It also identifies the extended partition, if there is one defined.

These are the values for the System ID field:

Value	Meaning
0x01	12-bit FAT partition or logical drive. The number of sectors in the volume is fewer than 32680.
0x04	16-bit FAT partition or logical drive. The number of sectors is between 32680 and 65535.
0x05	Extended partition. See section titled "Logical Drives and Extended Partitions," presented later in this chapter, for more information.
0x06	BIGDOS FAT partition or logical drive.
0x07	NTFS partition or logical drive.

Figure 3.6, presented earlier in this section, has examples of a BIGDOS FAT partition, an NTFS partition, an extended partition, and a 12-bit FAT partition.

When you create a volume set, stripe set, mirror set, or stripe set with parity, Disk Administrator sets the high bit of the System ID field for each primary partition or logical drive that is a member of the volume. For example, a FAT primary partition or logical drive that is a member of one of these volumes has a System ID value of 0x86. An NTFS primary partition or logical drive has a System ID value of 0x87. This bit indicates that Windows NT needs to use the HKEY_LOCAL_MACHINE \SYSTEM \DISK Registry subkey to determine how the members of the volume relate to each other. Volumes that have the high bit set can only be accessed by Windows NT. This bit is called the fault-tolerant (FT) bit.

When a primary partition or logical drive that is a member of one of these volumes has failed due to write errors or cannot be accessed, the second most significant bit is set. The System ID byte is set to C6 in the case of a FAT volume, or C7 in the case of an NTFS volume.

Note: If you start up MS-DOS, it can only access primary partitions or logical drives that have a value of 0x01, 0x04, 0x5, or 0x6 for the System ID. However, you should be able to delete volumes that have the other values. If you use a MS-DOS-based low-level disk editor, you can read and write any sector, including ones that are in NTFS volumes.

Starting and Ending Head, Sector, and Cylinder Fields

On x86-based computers, the Starting and Ending Head, Cylinder, and Sector fields on the startup disk are very important for starting up the computer. The code in the Master Boot Record uses these fields to find and load the Partition Boot Sector.

The Ending Cylinder field in the Partition Table is ten bits long, which limits the maximum cylinder number that can be described in the Partition Table to 1023. The Starting and Ending Head fields are one byte long, which limits this field to the range 0 – 255. The Starting and Ending Sector field is 6 bits long, limiting its range to 0 – 63. However, sectors start counting at 1 (versus 0 for the other fields), so the maximum number of sectors per track is 63.

Since current hard disks are low-level formatted with the industry standard 512-byte sector size, the maximum capacity disk that can be described by the Partition Table can be calculated as follows:

MaxCapacity = (sector size) x (sectors per track) x (cylinders) x (heads)

Substituting the maximum possible values yields:

512 x 63 x 1024 x 256 = 8,455,716,864 bytes or 7.8 GB (GB)

This calculation results in a maximum formatted capacity is slightly less than 8 GB.

However, the maximum cluster size that you can use for FAT volumes when running Windows NT is 64K, when using a 512 byte sector size. Therefore, the maximum size for a FAT volume is 4 GB.

If you have a dual-boot configuration with Windows 95 or MS-DOS, FAT volumes that might be accessed when using either of those operating systems are limited to 2 GB. In addition, Macintosh computers that are viewing volumes on a computer running Windows NT cannot see more than 2 GB. If you try to use a FAT volume larger than 2 GB when running MS-DOS or Windows 95, or access it from a Macintosh computer, you might get a message that there are 0 bytes available.

The maximum size of a FAT volume on a specific computer depends on the disk geometry, and the maximum values that can fit in the fields described in this section. The next table shows the typical size of a FAT volume when translation is enabled, and when it is disabled. The number of cylinders in both situations is 1024.

Translation mode	Number of heads	Sectors per track	Maximum size for system or boot partition
Disabled	64	32	1 GB
Enabled	255	63	4 GB

Note: RISC-based computers do not have a limit on the size of the system or boot partitions.

If a primary partition or logical drive extends beyond cylinder 1023, all of these fields will contain the maximum values.

Relative Sectors and Number of Sectors Fields

For primary partitions, the Relative Sectors field represents the offset from the beginning of the disk to the beginning of the partition, counting by sectors. The Number of Sectors field represents the total number of sectors in the partition. For a description of these fields in extended partitions, see the section "Logical Drives and Extended Partitions," presented later in this chapter.

Windows NT uses these fields to access all volumes. When you format a volume when running Windows NT, it puts data into the Starting and Ending Cylinder, Head, and Sector fields only for backward compatibility with MS-DOS and Windows 95, and to maintain compatibility with the BIOS interrupt (INT) 13 for startup purposes.

See the section titled "Using Disks With More Than 1024 Cylinders (x86-based Computers)," presented later in this chapter, for more information about the use of these fields.

Logical Drives and Extended Partitions

When more than four logical disks are required on a single physical disk, the first partition should be a primary partition. The second partition can be created as an extended partition, which can contain all the remaining unpartitioned space on the disk.

Note: A primary partition is one that can be used as the system partition. If the disk does not contain a system partition, you can configure the entire disk as a single, extended partition.

Some computers create an EISA configuration partition as the first partition on the hard disk.

Windows NT detects an extended partition because the System ID byte in the Partition Table entry is set to 5. There can be only one extended partition on a hard disk.

Within the extended partition, you can create any number of logical drives. As a practical matter, the number of available drive letters is the limiting factor in the number of logical drives that you can define.

When you have an extended partition on the hard disk, the entry for that partition in the Partition Table (at the end of the Master Boot Record) points to the first disk sector in the extended partition. The first sector of each logical drive in an extended partition also has a Partition Table, which is the last 66 bytes of the sector. (The last two bytes of the sector are the end-of-sector marker.)

These are the entries in an extended Partition Table:

• The first entry is for the current logical drive.

• The second entry contains information about the next logical drive in the extended partition.

• Entries three and four are all zeroes.

This format repeats for every logical drive. The last logical drive has only its own entry listed. The entries for partitions 2-4 are all zeroes.

The Partition Table entry is the only information on the first side of the first cylinder of each logical drive in the extended partition. The entry for partition 1 in each Partition Table contains the starting address for data on the current logical drive. And the entry for partition 2 is the address of the sector that contains the Partition Table for the next logical drive.

The use of the Relative Sector and Total Sectors fields for logical drives in an extended partition is different than for primary partitions. For the partition 1 entry of each logical drive, the Relative Sectors field is the sector from the beginning of the logical drive that contains the Partition Boot Sector. The Total Sectors field is the number of sectors from the Partition Boot Sector to the end of the logical drive.

For the partition 2 entry, the Relative Sectors field is the offset from the beginning of the extended partition to the sector containing the Partition Table for the logical drive defined in the Partition 2 entry. The Total Sectors field is the total size of the logical drive defined in the Partition 2 entry.

Note: If a logical drive is part of a volume set, the Partition Boot Sector is at the beginning of the first member of the volume set. Other members of the volume set have data where the Partition Boot Sector would normally be located.

This Disk Administrator screen shot shows a disk having an extended partition. The extended partition contains a volume set (drive E), two logical drives (drives I and K), and 4 MB of unallocated space. This screen shot is identical to the one shown in Figure 3.4.

The following example is a printout from the DiskMap program of the information in the Master Boot Record (the section titled MBR) and the extended Partition Table entries (the sections titled EBR) for the disk configuration shown in the preceding Disk Administrator screen shot. For information about DiskMap, see Chapter 7, "Disk, File System, and Backup Utilities."

MBR:
Starting               Ending       System    Relative  Total
Cylinder Head Sector  Cylinder Head Sector   ID      Sector    Sectors
*  0    1    1         406   15   63     0x06        63     410193
407    0    1         812   15   63     0x07    410256     409248
813    0    1         914   15   63     0x05    819504     102816
915    0    1         934   15   63     0x01    922320      20160

EBR: (sector 819504)
Starting               Ending       System    Relative  Total
Cylinder Head Sector  Cylinder Head Sector   ID      Sector    Sectors
813    1    1         832   15   63     0x87        63      20097
833    0    1         848   15   63     0x05     20160      16128

EBR: (sector 839664)
Starting               Ending       System    Relative  Total
Cylinder Head Sector  Cylinder Head Sector   ID      Sector    Sectors
833    1    1         848   15   63     0x01        63      16065
849    0    1         872   15   63     0x05     36288      24192

EBR: (sector 855792)
Starting               Ending       System    Relative  Total
Cylinder Head Sector  Cylinder Head Sector   ID      Sector    Sectors
849    1    1         872   15   63     0x07        63      24129
873    0    1         905   15   63     0x05     60480      33264

EBR: (sector 879984)
Starting               Ending       System    Relative  Total
Cylinder Head Sector  Cylinder Head Sector   ID      Sector    Sectors
873    1    1         905   15   63     0x87        63      33201
0    0    0           0    0    0     0x00         0          0

Partition Boot Sector

The Partition Boot Sector contains information that the file system uses to access the volume. On x86-based computers, the Master Boot Record use the Partition Boot Sector on the system partition to load the operating system Kernel files, or in the case of Windows NT, the boot loader.

The Windows NT Partition Boot Sector consists of:

• A jump instruction.

• The OEM name and version.

• A data structure called the BIOS Parameter Block.

• Another data structure called the extended BIOS Parameter Block.

• The bootstrap code.

The BIOS Parameter Block (bytes 11 through 35 of the Partition Boot Sector) describes physical parameters of the volume. The extended BIOS Parameter Block begins immediately after the BIOS Parameter Block. The length of this structure is different for FAT and NTFS volumes. The information in the BIOS Parameter Block and the extended BIOS Parameter Block is used by disk device drivers to read and configure volumes.

The Partition Boot Sector is the first 512-byte sector at the beginning of the volume. The sector always ends with 0x55AA, which is a sector signature word that marks the end of the sector.

FAT Partition Boot Sector

Table 3.2 describes the fields in the Partition Boot Sector for a volume formatted with the FAT file system. The sample values are the data in the corresponding fields in the hex dump in Figure 3.7, presented later in this section.

Table 3.2 Partition Boot Sector for FAT volumes

Byte Offset (in hex)	Field Length	Sample Value	Meaning
00	3 bytes	EB 3C 90	Jump instruction
03	8 bytes	MSDOS5.0	OEM Name in text
0B	25 bytes		BIOS Parameter Block
24	26 bytes		Extended BIOS Parameter Block
3E	448 bytes		Bootstrap code
1FE	2 bytes	0x55AA	End of sector marker

The following figure is a hex printout of the Partition Boot Sector for a FAT volume. The printout is formatted in three sections:

• Bytes 0 - 0x0A are the jump instruction and the OEM name.

• Bytes 0x0B - 0x3D are the BIOS Parameter Block and the Extended BIOS Parameter Block.

• The rest of the printout is the bootstrap code and the end of sector marker.

	 Physical Sector: Cyl 0, Side 1, Sector 1     
 	 00000000: EB 3C 90 4D 53 44 4F 53  - 35 2E 30                  <.MS-DOS5.0
 	 
 	 00 02 08 01 00              .....
 	 00000010: 02 00 02 00 00 F8 C9 00  - 3F 00 10 00 3F 00 00 00   ........?...?...
 	 00000020: 51 42 06 00 80 00 29 CE  - 13 46 30 4E 4F 20 4E 41   QB....)..F0NO NA
 	 00000030: 4D 45 20 20 20 20 46 41  - 54 31 36 20 20 20         ME    FAT16   
 	 
 	 33 C0                 3.
 	 00000040: 8E D0 BC 00 7C 68 C0 07  - 1F A0 10 00 F7 26 16 00   ....|h......&..
 	 00000050: 03 06 0E 00 50 91 B8 20  - 00 F7 26 11 00 8B 1E 0B   ....P.. ..&.....
 	 00000060: 00 03 C3 48 F7 F3 03 C8  - 89 0E 08 02 68 00 10 07   ...H........h...
 	 00000070: 33 DB 8F 06 13 02 89 1E  - 15 02 0E E8 90 00 72 57   3.............rW
 	 00000080: 33 DB 8B 0E 11 00 8B FB  - 51 B9 0B 00 BE DC 01 F3   3.......Q.......
 	 00000090: A6 59 74 05 83 C3 20 E2  - ED E3 37 26 8B 57 1A 52   .Yt... ...7&.W.R
 	 000000A0: B8 01 00 68 00 20 07 33  - DB 0E E8 48 00 72 28 5B   ...h. .3...H.r([
 	 000000B0: 8D 36 0B 00 8D 3E 0B 02  - 1E 8F 45 02 C7 05 F5 00   .6...>....E.....
 	 000000C0: 1E 8F 45 06 C7 45 04 0E  - 01 8A 16 24 00 EA 03 00   ..E..E.....$....
 	 000000D0: 00 20 BE 86 01 EB 03 BE  - A2 01 E8 09 00 BE C1 01   . ..............
 	 000000E0: E8 03 00 FB EB FE AC 0A  - C0 74 09 B4 0E BB 07 00   .........t......
 	 000000F0: CD 10 EB F2 C3 50 4A 4A  - A0 0D 00 32 E4 F7 E2 03   .....PJJ...2....
 	 00000100: 06 08 02 83 D2 00 A3 13  - 02 89 16 15 02 58 A2 07   .............X..
 	 00000110: 02 A1 13 02 8B 16 15 02  - 03 06 1C 00 13 16 1E 00   ................
 	 00000120: F7 36 18 00 FE C2 88 16  - 06 02 33 D2 F7 36 1A 00   .6........3..6..
 	 00000130: 88 16 25 00 A3 04 02 A1  - 18 00 2A 06 06 02 40 3A   ..%.......*...@:
 	 00000140: 06 07 02 76 05 A0 07 02  - 32 E4 50 B4 02 8B 0E 04   ...v....2.P.....
 	 00000150: 02 C0 E5 06 0A 2E 06 02  - 86 E9 8B 16 24 00 CD 13   ............$...
 	 00000160: 0F 83 05 00 83 C4 02 F9  - CB 58 28 06 07 02 76 11   .........X(...v.
 	 00000170: 01 06 13 02 83 16 15 02  - 00 F7 26 0B 00 03 D8 EB   ..........&.....
 	 00000180: 90 A2 07 02 F8 CB 42 4F  - 4F 54 3A 20 43 6F 75 6C   ......BOOT: Coul
 	 00000190: 64 6E 27 74 20 66 69 6E  - 64 20 4E 54 4C 44 52 0D   dn't find NTLDR.
 	 000001A0: 0A 00 42 4F 4F 54 3A 20  - 49 2F 4F 20 65 72 72 6F   ..BOOT: I/O erro
 	 000001B0: 72 20 72 65 61 64 69 6E  - 67 20 64 69 73 6B 0D 0A   r reading disk..
 	 000001C0: 00 50 6C 65 61 73 65 20  - 69 6E 73 65 72 74 20 61   .Please insert a
 	 000001D0: 6E 6F 74 68 65 72 20 64  - 69 73 6B 00 4E 54 4C 44   nother disk.NTLD
 	 000001E0: 52 20 20 20 20 20 20 00  - 00 00 00 00 00 00 00 00   R      .........
 	 000001F0: 00 00 00 00 00 00 00 00  - 00 00 00 00 00 00 55 AA   ..............U.

Figure 3.7. Partition Boot Sector for a FAT volume on x86-based computer

Table 3.3 shows the layout of the BIOS Parameter Block and the extended BIOS Parameter Block. The sample values correspond to the data in Figure 3.7.

Table 3.3 BIOS Parameter Block and Extended BIOS Parameter Block Fields for FAT volumes

Byte Offset	Field Length	Value	Meaning
0x0B	WORD	0x0002	Bytes per Sector. The size of a hardware sector. For most disks in use in the United States, the value of this field is 512.
0x0D	BYTE	0x08	Sectors Per Cluster. The number of sectors in a cluster. The default cluster size for a volume depends on the volume size and the file system.
0x0E	WORD	0x0100	Reserved Sectors. The number of sectors from the Partition Boot Sector to the start of the first file allocation table, including the Partition Boot Sector. The minimum value is 1. If the value is greater than 1, it means that the bootstrap code is too long to fit completely in the Partition Boot Sector.
0x10	BYTE	0x02	Number of file allocation tables (FATs). The number of copies of the file allocation table on the volume. Typically, the value of this field is 2.
0x11	WORD	0x0002	Root Entries. The total number of file name entries that can be stored in the root folder of the volume.
0x13	WORD	0x0000	Small Sectors. The number of sectors on the volume if the number fits in 16 bits (65535). For volumes larger than 65536 sectors, this field has a value of 0 and the Large Sectors field is used instead.
0x15	BYTE	0xF8	Media Type. Provides information about the media being used. A value of 0xF8 indicates a hard disk.
0x16	WORD	0xC900	Sectors per file allocation table (FAT). Number of sectors occupied by each of the file allocation tables on the volume.
0x18	WORD	0x3F00	Sectors per Track. The apparent disk geometry in use when the disk was formatted.
0x1A	WORD	0x1000	Number of Heads. The apparent disk geometry in use when the disk was formatted.
0x1C	DWORD	3F 00 00 00	Hidden Sectors. Same as the Relative Sector field in the Partition Table.
0x20	DWORD	51 42 06 00	Large Sectors. If the Small Sectors field is zero, this field contains the total number of sectors in the volume. If Small Sectors is nonzero, this field contains zero.
0x24	BYTE	0x80	Physical Disk Number. This is related to the BIOS physical disk number. Floppy drives are numbered starting with 0x00 for the A disk. Physical hard disks are numbered starting with 0x80. The value is typically 0x80 for hard disks, regardless of how many physical disk drives exist, because the value is only relevant if the device is the startup disk.
0x25	BYTE	0x00	Current Head. Not used by the FAT file system. Therefore, Windows NT uses this field to store two flags: • The low order bit is a dirty flag, used to indicate that Windows NT should run the Chkdsk program against the volume when it starts. • The second lowest bit indicates to that a surface scan should also be run.
0x26	BYTE	0x29	Signature. Must be either 0x28 or 0x29 in order to be recognized by Windows NT.
0x27	4 bytes	CE 13 46 30	Volume Serial Number. A unique number that is created when you format the volume.
0x2B	11 bytes	NO NAME	Volume Label. This field was used to store the volume label, but the volume label is now stored as special file in the root directory.
0x36	8 bytes	FAT16	System ID. Either FAT12 or FAT16, depending on the format of the disk.

NTFS Partition Boot Sector

Table 3.4 describes the fields in the Partition Boot Sector for a volume formatted with the NTFS file system. The sample values are the data in the corresponding fields in the hex dump in Figure 3.8, presented later in this section.

Table 3.4 Partition Boot Sector for NTFS volume

Byte Offset (in hex)	Field Length	Sample Value	Meaning
00	3 bytes	EB 5B 00	Jump instruction
03	8 bytes	NTFS	OEM Identifier
0B	25 bytes		BIOS Parameter Block
24	48 bytes		Extended BIOS Parameter Block
54	426 bytes		Bootstrap code
1FE	WORD	0x55AA	End of sector marker

Note: The bootstrap code for an NTFS volume is longer than the 426 bytes shown here. When you format an NTFS volume, the format program allocates the first 16 sectors for the Partition Boot Sector and the bootstrap code.

The extra data fields after the BIOS Parameter Block form an extended BIOS Parameter Block for NTFS. The data in these fields enable the boot loader to find the Master File Table (MFT) during the startup process. In the NTFS file system, the MFT is not located in a predefined sector as is the case for the file allocation table on a FAT volume. Thus, the MFT can be moved if there is a bad sector in its normal location. However, if these data are corrupt, the MFT cannot be located and Windows NT assumes the volume has not been formatted.

Note: The MFT contains information about all of the files on an NTFS volume. See Chapter 17, "Disk and File System Basics," in the Windows NT Workstation Resource Guide for details about the MFT.

The following figure is a hex dump of the Partition Boot Sector for an NTFS volume (formatted when running Windows NT 4.0). The printout is formatted in three sections:

• Bytes 0 - 0x0A are the jump instruction and the OEM name.

• Bytes 0x0B - 0x53 are the BIOS Parameter Block and the Extended BIOS Parameter Block.

• The rest of the printout is the bootstrap code and the end of sector marker.

    Physical Sector: Cyl 407, Side 0, Sector 1     
    00000000: EB 5B 90 4E 54 46 53 20  - 20 20 20                  .[.NTFS    

    00 02 01 00 00              .....
    00000010: 00 00 00 00 00 F8 00 00  - 3F 00 10 00 90 42 06 00   ........?....B..
    00000020: 00 00 00 00 80 00 80 00  - A0 3E 06 00 00 00 00 00   .........>......
    00000030: 10 00 00 00 00 00 00 00  - 51 1F 03 00 00 00 00 00   ........Q......
    00000040: 02 00 00 00 04 00 00 00  - 5B 1F DD 2C 4F DD 2C A2   ........[.,O.,.
    00000050: 00 00 00 00                                          ....
 
    00 00 00 00  - 00 00 00 00 00 FA 33 C0       ..........3.
    00000060: 8E D0 BC 00 7C FB B8 C0  - 07 8E D8 C7 06 54 00 00   ....|........T..
    00000070: 00 C7 06 56 00 00 00 C7  - 06 5B 00 10 00 B8 00 0D   ...V.....[......
    00000080: 8E C0 2B DB E8 07 00 68  - 00 0D 68 56 02 CB 50 53   ..+....h..hV..PS
    00000090: 51 52 06 66 A1 54 00 66  - 03 06 1C 00 66 33 D2 66   QR.f.T.f....f3.f
    000000A0: 0F B7 0E 18 00 66 F7 F1  - FE C2 88 16 5A 00 66 8B   .....f......Z.f.
    000000B0: D0 66 C1 EA 10 F7 36 1A  - 00 88 16 25 00 A3 58 00   .f....6....%..X.
    000000C0: A1 18 00 2A 06 5A 00 40  - 3B 06 5B 00 76 03 A1 5B   ...*.Z.@;.[.v..[
    000000D0: 00 50 B4 02 8B 16 58 00  - B1 06 D2 E6 0A 36 5A 00   .P....X......6Z.
    000000E0: 8B CA 86 E9 8A 36 25 00  - B2 80 CD 13 58 72 2A 01   .....6%.....Xr*.
    000000F0: 06 54 00 83 16 56 00 00  - 29 06 5B 00 76 0B C1 E0   .T...V..).[.v...
    00000100: 05 8C C2 03 D0 8E C2 EB  - 8A 07 5A 59 5B 58 C3 BE   ..........ZY[X..
    00000110: 59 01 EB 08 BE E3 01 EB  - 03 BE 39 01 E8 09 00 BE   Y.........9.....
    00000120: AD 01 E8 03 00 FB EB FE  - AC 3C 00 74 09 B4 0E BB   .........<.t....
    00000130: 07 00 CD 10 EB F2 C3 1D  - 00 41 20 64 69 73 6B 20   .........A disk 
    00000140: 72 65 61 64 20 65 72 72  - 6F 72 20 6F 63 63 75 72   read error occur
    00000150: 72 65 64 2E 0D 0A 00 29  - 00 41 20 6B 65 72 6E 65   red....).A kerne
    00000160: 6C 20 66 69 6C 65 20 69  - 73 20 6D 69 73 73 69 6E   l file is missin
    00000170: 67 20 66 72 6F 6D 20 74  - 68 65 20 64 69 73 6B 2E   g from the disk.
    00000180: 0D 0A 00 25 00 41 20 6B  - 65 72 6E 65 6C 20 66 69   ...%.A kernel fi
    00000190: 6C 65 20 69 73 20 74 6F  - 6F 20 64 69 73 63 6F 6E   le is too discon
    000001A0: 74 69 67 75 6F 75 73 2E  - 0D 0A 00 33 00 49 6E 73   tiguous....3.Ins
    000001B0: 65 72 74 20 61 20 73 79  - 73 74 65 6D 20 64 69 73   ert a system dis
    000001C0: 6B 65 74 74 65 20 61 6E  - 64 20 72 65 73 74 61 72   kette and restar
    000001D0: 74 0D 0A 74 68 65 20 73  - 79 73 74 65 6D 2E 0D 0A   t..the system...
    000001E0: 00 17 00 5C 4E 54 4C 44  - 52 20 69 73 20 63 6F 6D   ...\NTLDR is com
    000001F0: 70 72 65 73 73 65 64 2E  - 0D 0A 00 00 00 00 55 AA   pressed.......U.

Figure 3.8. Partition Boot Sector for a NTFS volume on an x86-based computer

The next table describes the fields for the BIOS Parameter Block and the Extended BIOS Parameter Block. The fields starting at 0x0B, 0x0D, 0x15, 0x18, 0x1A, and 0x1C are the same as the corresponding fields for FAT volumes, as described in Table 3.3.

Table 3.5 BIOS Parameter Block and Extended BIOS Parameter Block Fields for NTFS volumes

Byte Offset	Field Length	Sample Value	Meaning
0x0B	WORD	0x0002	Bytes per Sector.
0x0D	BYTE	0x01	Sectors per Cluster.
0x0E	WORD	0x0000	Reserved sectors.
0x10	BYTE	0x00	Always 0.
0x11	WORD	0x0000	Always 0.
0x13	WORD	0x0000	Not used by NTFS.
0x15	BYTE	0xF8	Media Type.
0x16	WORD	0x0000	Always 0.
0x18	WORD	0x3F00	Sectors per Track.
0x1A	WORD	0x1000	Number of Heads.
0x1C	DWORD	90 42 06 00	Hidden Sectors.
0x20	DWORD	00 00 00 00	Not used by NTFS.
0x24	DWORD	80 00 80 00	Not used by NTFS.
0x28	LONGLONG	A0 3E 06 00 00 00 00 00	Total Sectors.
0x30	LCN	10 00 00 00 00 00 00 00	Logical cluster number for $MFT.
0x38	LCN	51 1F 03 00 00 00 00 00	Logical cluster number for $MFTMirr.
0x40	DWORD	02 00 00 00	Clusters per file record segment.
0x44	DWORD	04 00 00 00	Clusters per index block.
0x48	LONGLONG	5B 1F DD 2C 4F DD 2C A2	Volume Serial Number.
0x50	DWORD	00 00 00 00	Checksum.

For information about the Master File Table and the $MFT and $MFTMirr files, see Chapter 17, "Disk and File System Basics," in the Windows NT Workstation Resource Guide.

What Happens When You Start Your Computer

This section describes what happens when you start a computer that has a Windows NT installed as one of the operating systems. In general, this section describes what happens at each step in the process when the computer successfully starts. Chapter 6, "Troubleshooting Startup and Disk Problems," discusses what you can do to isolate startup problems and how to recover from them.

These are the steps involved in the successful startup of Windows NT:

• Power On Self Test (POST) processing

• Initial startup process

• Boot loader process

• Selecting the operating system

• Detecting hardware

• Selecting a configuration

• Loading the Kernel

• Initializing the Kernel

• Logging on

The order and the processing is somewhat different, depending upon the hardware platform (x86-based computer or RISC-based computer).

The startup process begins when you:

• Power on the computer.

• Click Shutdown and Restart on the Shutdown Computer dialog box.

• Select Restart the computer from the Shut Down Windows dialog box.

When you see the Begin Logon dialog box, with the text Press Ctrl+Alt+Delete to log on, your computer has completed the loading of Windows NT, and has completed much of the initialization. However, startup is complete only when a user can successfully log on at the Begin Logon dialog box.

Windows NT might not start up or operate correctly if any hardware components do not initialize correctly. Startup fails if any of the files required to start Windows NT are not present in the correct folder, or if one of the files has been corrupted. Table 3.6 describes the files that x86-based computers and RISC-based computers use to start Windows NT.

Table 3.6 Files required to start up Windows NT

x86-based file	Folder	RISC-based file	Folder
NTLDR	root of startup disk	Osloader.exe	\Os\Nt40
Boot.ini	root of startup disk	no equivalent
Bootsect.dos	root of startup disk	no equivalent
Ntdetect.com	root of startup disk	no equivalent
Ntbootdd.sys (SCSI only)	root of startup disk
Ntoskrnl.exe	%systemroot%\ System32	Ntoskrnl.exe	%systemroot%\ System32
Hal.dll	%systemroot%\ System32	Hal.dll	\Os\Nt40
no equivalent		*.pal files (Alpha-based computers)	\Os\Nt40
SYSTEM key	%systemroot%\ System32\Config	SYSTEM key	%systemroot%\ System32\Config
device drivers	%systemroot%\ System32\Drivers	device drivers	%systemroot%\ System32\Drivers

Power On Self Test Processing

When you power on or restart a computer, it goes through its Power On Self Test (POST) routine, which determines:

• The amount of real memory.

• Whether the needed hardware components (such as the keyboard) are present.

Once the computer has run its POST routine, each adapter card with a BIOS runs its own POST routine. The computer and adapter card manufacturers determine what appears on the screen during the POST processing.

Initial Startup Process

The first sector on the hard disk is critical to the startup process. This sector contains the Master Boot Record and the Partition Table.

If the startup disk is a floppy disk, the first sector on the disk is the Partition Boot Sector.

For more information about the Master Boot Record, the system partition, and the Partition Boot Sector, see "Disk Sectors Critical to the Startup Process," presented earlier in this chapter.

Starting an x86-based Computer

After the POST on x86-based computers, the system BIOS attempts to locate the startup disk. If there is a floppy disk in drive A, the system BIOS uses drive A as the startup disk. If there is no disk in drive A, it then checks the first hard disk that is powered up.

Note: Some system BIOS versions enable the user to reconfigure the order in which it checks the floppy disks and hard disks for the startup disk.

When the hard disk is the startup disk, the system BIOS reads the Master Boot Record, and loads it into memory. The system BIOS then transfers execution to the Master Boot Record. The code in the Master Boot Record scans the Partition Table for the system partition. When the Master Boot Record finds the system partition, it loads sector 0 of the partition into memory, and executes the code in the sector. Sector 0 on the system partition can be a program or diagnostic program, or a Partition Boot Sector that contains startup code for an operating system. The Partition Boot Sector code starts the operating system in a manner defined by the operating system.

If there is no system partition on the first hard disk, the Master Boot Record displays errors such as the following:

• Invalid partition table

• Error loading operating system

• Missing operating system

If there is a floppy disk in drive A, the system BIOS loads the first sector on the disk into memory. If the floppy is bootable, the first sector on the disk is the Partition Boot Sector. If the floppy disk is not bootable, you see errors such as:

Non-System disk or disk error
Replace and press any key when ready

Starting a RISC-based Computer

After a RISC-based computer completes the POST routine, the resident ROM firmware selects a startup disk by reading a boot precedence table from nonvolatile RAM (NVRAM). What the firmware does depends upon the platform (Alpha, PPC, or MIPS computer) and the information in the NVRAM. For example, to startup from the floppy disk, the NVRAM must define it as an alternate boot selection.

The NVRAM also defines the:

• Location for OSLOADER.

• Path to the boot partition.

• Folder that contains the operating system to start.

The system partition can be on any hard disk on RISC-based computers. You can use the Boot selection menu to set up or change the system partition. See "Manage Boot Selection Menu," in Chapter 19, "What Happens When You Start Your Computer," of the Windows NT Workstation Resource Guide for more information about changing the NVRAM on RISC-based computers.

The system partition on a RISC-based computer must be formatted with the FAT file system.

Boot Loader Process

The boot loader enables you to select the operating system that you want to start and loads the operating system files from the boot partition. Boot loader processing is different on x86-based and RISC-based computers.

NTLDR Functions (x86-based Computers)

NTLDR controls the operating system selection process and hardware detection prior to the Windows NT Kernel initialization. NTLDR must be in the root folder.

When NTLDR starts executing, it clears the screen and displays the boot loader message, which is:

OS Loader V4.0

OSLOADER Functions (RISC-based Computers)

On RISC-based computers, Osloader.exe performs all of the functions that are performed by the x86-based components NTLDR, Ntdetect.com, and Bootsect.dos.

The NVRAM contains environment variables that provide the functional equivalent of the Boot.ini file on x86-based computers.

Selecting the Operating System to Start

The boot loader displays the screen from which you select the operating system to start. The information on the screen is different for x86-based computers and RISC-based computers.

Boot Loader Screen (x86-based Computer)

NTLDR displays a menu from which you select the operating system to start. This screen is based upon the information in the Boot.ini file. The screen looks like this:

OS Loader V4.0

Please select the operating system to start:

Windows NT Server Version 4.0
Windows NT Server Version 4.0 (VGA mode)

Use [up] and [down] to move the highlight to your choice.
Press Enter to choose.

Seconds until highlighted choice will be started automatically: 29

If you do not select an entry before the counter reaches zero, NTLDR loads the operating system specified by the default parameter in the Boot.ini file. Windows NT Setup sets the default entry to the most recent copy of Windows NT that you installed. You can edit the Boot.ini file to change the default entry if you want to default to an operating system other than the most recently installed version of Windows NT.

For information about changing the Boot.ini file, see "Contents and Purpose of Boot.ini," presented later in this chapter.

Boot Menu (RISC-based Computers)

The Boot menu contains the boot options. The first selection is always the default operating system, which is the most recently installed version of Windows NT unless you change the order of the boot selections.

To change the default operating system, or add or change alternate operating system choices, see the section titled "Manage Boot Selection Menu," in Chapter 19, "What Happens When You Start Your Computer," of the Windows NT Workstation Resource Guide.

This is a sample Boot menu from an Alpha-based computer:

ARC Multiboot Alpha AXP Version 3.5-11 
Copyright (c) 1993 Microsoft Corporation
Copyright (c) 1993 Digital Equipment Corporation

Boot Menu:

Boot Windows NT Server Version 4.0
Boot an alternate operating system
Run a program
Supplementary menu. . .

Use the arrow keys to select, then press Enter.
Seconds until auto-boot. Select another option to override: 9

The first line on the Boot menu is highlighted. Pressing ENTER begins startup of the default operating system.

If you have included alternate boot selections in your NVRAM, you can select Boot an alternate operating system, which results in a screen like the following.

ARC Multiboot Alpha AXP Version 3.5-11 
Copyright (c) 1993 Microsoft Corporation
Copyright (c) 1993 Digital Equipment Corporation

Boot Menu:

Boot Windows NT Server 4.0 (Default)
Boot Windows NT Server 3.51 

Use the arrow keys to select, then press Enter.

Detecting Hardware

On RISC-based computers, Osloader.exe obtains the hardware information from the NVRAM.

Ntdetect.com is the hardware recognizer for x86-based computers. It collects a list of currently installed components and returns this information to NTLDR. Ntdetect.com executes after you select a Windows NT operating system on the boot loader screen (or the timer times out). When Ntdetect.com begins to execute, you see the following line on the screen:

NTDETECT V1.0 Checking Hardware . . .

Ntdetect.com detects the following components:

• Computer ID

• Bus/Adapter Type

• Video

• Keyboard

• Communication Ports

• Parallel Ports

• Floppy Disks

• Mouse/Pointing Device

Selecting a Configuration

When you have selected the version of Windows NT to start, and the boot loader has collected hardware information, you see the following screen:

OS Loader V4.0

Press spacebar now to invoke Hardware Profile/Last Known Good menu.

The boot loader waits a few seconds for you to press the spacebar. If you do not press the spacebar and you have only one hardware profile, the boot loader loads Windows NT by using the Default configuration. Otherwise, you see this screen:

Hardware Profile/Configuration Recovery Menu

This menu allows you to select a hardware profile
to be used when Windows NT is started.

If your system is not starting correctly, then you may switch to a previous system configuration, 
which may overcome startup problems.
IMPORTANT: System configuration changes made 
since the last successful startup will be discarded.

Original Configuration
some other hardware profile

Use the up and down arrow keys to move the highlight
to the selection you want. Then press ENTER.
To switch to the Last Known Good Configuration, press 'L'.
To Exit this menu and restart your computer. press F3.

Seconds until highlighted choice will be started automatically: 5

The first hardware profile is highlighted. If you have created other hardware profiles, use the down arrow to select the one that you want to use. For more information about hardware profiles, use the Find tab in Windows NT Help and enter profile.

You can also select between the Last Known Good Configuration and the Default Configuration. Windows NT automatically uses the Default Configuration if you do not select the Last Known Good Configuration. When you use the Default Configuration, the boot loader uses the Registry information that Windows NT saved at the last shutdown.

If you switch to the Last Known Good Configuration by pressing L and ENTER, the boot loader uses the Registry information that it saved at the completion of the last successful startup to configure this startup.

For more information about control sets, the Last Known Good Configuration, and the Default Configuration, see Chapter 8, "General Troubleshooting."

Loading the Kernel

When you press ENTER on the Hardware Profile/Configuration Recovery menu or the boot loader automatically makes the selection for you, the computer is in the Kernel load phase of Windows NT startup. You see several dots as the boot loader loads the Windows NT Kernel (Ntoskrnl.exe) and the hardware abstraction layer (Hal.dll) into memory.

At this point, the boot loader creates the control set it will use to initialize the computer. The control set is either the Default control set or the Last Known Good control set. The boot loader loads the low-level device drivers based on the ones identified in the control set.

Initializing the Kernel

You know that the Kernel is initializing when the screen turns blue, and you see text similar to the following:

Microsoft (R) Windows NT (TM) Version 4.0 (Build 1345)
1 System Processor (16 MB Memory)

This means that Ntoskrnl.exe has successfully initialized and that control has passed to it.

During the Kernel initialization phase, the Kernel:

• Initializes the low-level device drivers that were loaded in the previous phase.

• Loads and initializes the other device drivers.

• Runs programs, such as Chkdsk, that need to be run before it loads any services.

• Load and initializes services.

• Creates the page file.

• Starts subsystems that are needed to run Windows NT.

Logging on

When Kernel initialization finishes, you see the Begin Logon dialog box, which contains the text Press Ctrl + Alt + Delete to log on. At this time, Windows NT might still be initializing network drivers, but you can logon now.

Note: Windows NT startup is not considered good until a user successfully logs on to the system.

Contents and Purpose of Boot.ini (x86-based Computers)

When you install Windows NT on an x86-based computer, Windows NT Setup puts the Boot.ini file at the root of the system partition. NTLDR uses information in the Boot.ini file to display the screen from which you select the operating system to start.

Here is a sample Boot.ini file:

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINNT
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINNT="Windows NT Server Ver 4.0" 
multi(0)disk(0)rdisk(0)partition(1)\WINNT="Windows NT Server Ver 4.0 [VGA mode]" /basevideo /sos 

The Boot.ini file has two sections, [boot loader] and [operating system], which are described in the next two sections.

[boot loader] Section

This section contains the following information:

Parameter	Description
timeout	The number of seconds the user has to select an operating system from the boot loader screen before NTLDR loads the default operating system. If the value is 0, NTLDR immediately starts the default operating system without displaying the boot loader screen. You can also set this value to -1, in which case NTLDR waits forever for you to make a selection. You must edit the Boot.ini file to set the value to -1 because it is an illegal value for the System option in Control Panel.
default	The path to the default operating system.

[operating systems] Section

This section contains the list of available operating systems. Each entry includes the path to the boot partition for the operating system, the string to display in the boot loader screen, and optional parameters. There is an example of the use of this section of the Boot.ini file in the section titled "Boot Loader Screen (x86-based Computers)," presented earlier in this chapter.

The Boot.ini file supports starting multiple versions of Windows NT operating systems, as well as starting one other operating system. The other operating systems that can be included in the Boot.ini file are Windows 95, MS-DOS, and OS/2. The section "Configuring the Computer for Dual-booting and Triple-booting," in Chapter 19, "What Happens When You Start Your Computer," of the Windows NT Workstation Resource Guide, contains more information about the other operating systems.

Boot.ini Switches

There are several switches that you can add to the end of the Windows NT entries in the [operating system] section of the Boot.ini file. They are not case sensitive. Chapter 6, "Troubleshooting Startup and Disk Problems," contains more information about many of these switches. For information about the debugger, see Chapter 39, "Windows NT Debugger," in the Windows NT Workstation Resource Guide.

Switch	Description
/BASEVIDEO	The computer starts up using the standard VGA video driver. If you have installed a new video driver, but it is not working correctly, selecting the Windows NT entry with this switch enables you to start the computer so you can change to a different driver.
/BAUDRATE	Specifies the baud rate to be used for debugging. If you do not set the baud rate, the default baud rate is 9600 if a modem is attached, and 19200 for a null-modem cable. This switch has a secondary effect of forcing the /DEBUG switch as well, whether or not use you use /DEBUG.
/CRASHDEBUG	The debugger is loaded when you start Windows NT, but remains inactive unless a Kernel error occurs. This mode is useful if you are experiencing random, unpredictable Kernel errors.
/DEBUG	The debugger is loaded when you start Windows NT, and can be activated at any time by a host debugger connected to the computer. This is the mode to use when you are debugging problems that are regularly reproducible.
/DEBUGPORT= comx	Specifies the com port to use for debugging, where x is the communications port that you want to use. Like /BAUDRATE, this switch will also force the /DEBUG mode.
/MAXMEM:n	Specifies the maximum amount of RAM that Windows NT can use. This switch is useful if you suspect a memory chip is bad. See Chapter 6, "Troubleshooting Disk and Startup Problems," for more information.
/NODEBUG	No debugging information is being used.
/NOSERIALMICE=[COMx | COMx,y,z...]	Disables serial mouse detection of the specified COM port(s). Use this switch if you have a component other than a mouse attached to a serial port during the startup sequence. If you use /NOSERIALMICE without specifying a COM port, serial mouse detection is disabled on all COM ports. See Chapter 5, "Preparing for and Performing Recovery," for more information.
/SOS	Displays the driver names while they are being loaded. Use this switch if Windows NT won't start up and you think a driver is missing. See Chapter 6, "Troubleshooting Startup and Disk Problems," for more information.

Editing Boot.ini

When you install Windows NT, the Boot.ini file has the Read Only, System, and Hidden attributes set. You can edit the timeout and default parameters in the Boot.ini file by using the System option on Control Panel, regardless of the value of these attributes.

If you want to edit the Boot.ini file by using a text editor, you need to make the file visible before you can open it, and you need to turn off the Read Only attribute to be able to make changes to it. You can change the attributes by using My Computer, Windows NT Explorer, or the command prompt.

To change the attributes in My Computer or Windows NT Explorer

1. On the View menu, click Options.

2. On the Options tab, select Show all files. Click OK.

3. Click the filename.

4. On the File menu, click Properties.

5. In the Attributes box of the General tab, clear the Read Only, System, and Hidden check boxes, and then click OK.

To change the attributes by using command prompt, enter:

attrib -s -h -r boot.ini

If you change the path to the Windows NT boot partition, make sure to edit both the default path and operating system path entries. If you change one but not the other, a new choice is added to the boot loader screen, with the default designator next to it.

Using Hard Disks With More Than 1024 Cylinders (x86-based Computers)

Windows NT can take advantage of hard disks with more than 1024 cylinders if you enable extended translation. Windows NT does not have a limit to the number of cylinders it can address, but the system and boot partitions are limited to 1024 cylinders by the system BIOS, which must use INT 13 to access the disk during startup. The section "Starting and Ending Head, Sector, and Cylinder Fields," presented earlier in this chapter, contains more information about the system and boot partitions.

The following error messages might appear when extended translation is not enabled on disks larger than 1024 cylinders, and the Master Boot Record is unable to locate the Partition Boot Sector:

• Error loading operating system.

• Missing operating system.

If you create your system and boot partitions in Windows NT Setup, you do not have to concern yourself with these details, because Setup will not create a partition that cannot be used to start Windows NT.

When Windows NT has completed startup, it does not use the values in the Starting and Ending Head, Sector, and Cylinder fields of the Partition Table. Instead, it uses the Relative Sectors and Number Of Sectors fields. These fields provide a full 32 bits to represent sectors, which results in volumes of up to 232 sectors.

With a standard sector size of 512 bytes, the 32-bit fields used for the Relative Sectors and Number of Sectors result in a maximum possible volume size of:

512 bytes x 4,294,967,296 = 2,199,023,255,552 bytes, or 2 TB.

When creating primary partitions or logical drives on a disk, Windows NT writes the correct values to the Partition Table fields whenever possible. When the Ending Cylinder field for an entry in the Partition Table goes beyond cylinder 1023, Windows NT writes the maximum permitted values to these fields in the Partition Table. This prevents the system BIOS from calculating the Starting and Ending addresses based on erroneous data.

There are several Knowledge Base articles that discuss using large disks. Knowledge Base articles are included on the Windows NT Server Resource Kit.

SCSI Hard Disks

If your SCSI controller can be configured to perform translation, you can create a boot partition or system partition that is within the first 1 or 4 GB of the disk, depending upon the translation used by the controller. To create the largest possible system and boot partitions, you need to enable translation on the controller. If translation was not already enabled, you will need to low-level format the hard disk, recreate partitions, and format them. Check with your hardware manufacturer for specific advice and details.

Once Windows NT has been initialized, it uses its SCSI disk device drivers to directly interact with the disk without using the BIOS INT 13 interface. Therefore, the Starting and Ending Head, Sector, and Cylinder fields are not important after the computer has completed startup.

Note: If you are using, or going to use, a mirror set for your system partition, there are reasons that you should not enable translation on the controller. See Chapter 5, "Preparing for and Performing Recovery," for more information.

IDE and EIDI Hard Disks

The system and boot partitions on IDE hard disks are also limited to 1024 cylinders if the controller does not translate the disk address. Secondary disks that do not contain the system or boot partition might not be limited to 1024 cylinders, depending on the translation scheme used by the controller and disk.

IDE disks use a different data structure for representing the number of cylinders, number of heads, and number of sectors per track than the Partition Table and BIOS INT 13 interface. According to the IDE specifications, the maximum number of cylinders is 65536, the maximum number of heads is 16, and the maximum number of sectors per track is 255. The maximum size is 136.9 GB. Because the BIOS/IDE interface has been constrained to use the lowest common denominator, the result is a limit of about 504 MB for an IDE disk on an Intel-based ISA bus computer.

There are new controllers and disk device drivers that use an Enhanced Disk Parameter Table to translate between the logical sector layout internal to the IDE disk and the logical sector layout addressable by the BIOS INT 13 interface. These disk drivers and devices can support larger disks. These disks and controllers are referred to as enhanced IDE, or EIDE, devices.

ESDI Hard Disks

ESDI disks are an older type that came before the IDE disks.

ESDI disks use the CHS (cylinder, head, sector) addressing and have a 1024 cylinder limitation. Some controller cards get around this limitation by implementing a translation scheme in the onboard controller BIOS.

The translation is totally transparent to Windows NT, and the standard disk device driver works without any change.

ESDI disks are capable of being low-level formatted with various values of sector per track, such as 53 or 63. Here are two examples:

1024 cylinders x 15 heads x 53 sectors per track x 512 bytes per sector = 398 MB

1024 cylinders x 15 heads x 63 sectors per track x 512 bytes per sector = 472 MB

Thus, using 63 sectors per track yields 74 MB more space. Windows NT is compatible with either geometry, and, depending on the disk or controller, can access cylinders beyond 1023. You can use Windows NT to create and format the disk space beyond cylinder 1023, but it cannot be accessed by MS-DOS. However, some controllers can remap the remaining cylinders beyond 1023 so that either MS-DOS or Windows NT can use the entire capacity. For example:

1632 cylinders x 15 heads x 53 sectors per track x 512 bytes per sector = 634 MB

Microsoft has tested the ESDI controllers described in the following table.

Table 3.8 Using More Than 1024 Cylinders on ESDI Controllers

Controller	Achieving Maximum Capacity
Data Technology Corp. (DTC) Model 6282-24	The maximum MS-DOS geometry is 63 sectors per track and 1024 cylinders. Windows NT can access the cylinders beyond 1023. Do not perform a low-level format on the disk using Head Mapping mode.
Data Technology Corp. (DTC) Model 6290-24	The maximum MS-DOS geometry is 63 sectors per track and 1024 cylinders. Because this controller card does not have an on-board BIOS, Windows NT cannot access the cylinders beyond 1023.
Data Technology Corp. (DTC) Model 6290 SEZ (Dual SCSI/ESDI Controller)	The maximum MS-DOS geometry is 63 sectors per track and 1024 cylinders. Windows NT can access the cylinders beyond 1023.
Data Technology Corp. (DTC) Model 6295-24	The maximum MS-DOS geometry is 63 sectors per track and 1024 cylinders. This controller card does have an on-board BIOS, so Windows NT can access the cylinders beyond 1024. Do not perform a low-level format on the disk using Head Mapping mode.
Adaptec Model 2322D	Option 1. Disable disk translation and the on-board controller BIOS. In the CMOS, use a user-defined disk type with the actual disk parameters, such as Disk Type=48, Cylinders=1632, Heads=15, Sectors per Track=53. These parameters result in a 634 MB capacity. MS-DOS is limited to the first 1024 cylinders, which makes 398 MB available. Windows NT can access beyond cylinder 1023, yielding another 236 MB. Option 2. Both MS-DOS and Windows NT can access the entire disk. Set jumpers on the controller for Disk Splitting. Disable disk translation and the on-board controller BIOS. Set up the first physical disk in CMOS as Cylinders=1024, Heads=15, Sectors per Track=53. This gives a disk capacity of 398 MB. Set up the second disk (it appears as a physical disk) in the CMOS as Cylinders=606, Heads=15, sectors per track=53. This yields another 236 MB. Windows NT sees the disk as two physical disks.
UltraStor with PROM versions < nnnn-009	The maximum MS-DOS geometry is 63 sectors per track and 1024 cylinders. Windows NT can access the cylinders beyond 1023.
UltraStor with PROM versions >= nnnn-009	The maximum MS-DOS geometry is 63 sectors per track and 1024 cylinders. Both MS-DOS and Windows NT have access to the entire disk capacity.

Using Removable Disks and Floppy Disks

Most types of removable media can work with Window NT. Even though removable media are assigned a floppy disk icon in My Computer and Windows NT Explorer, they are not handled by the same part of the operating system. Floppy disks are handled by Floppy.sys. All SCSI-based removable media are handled through the normal SCSI disk device drivers. Most magneto-optical, Bernoulli, Syquest, and similar removable-media disks are treated like hard disks under Windows NT, and do not require special disk device drivers.

You can use My Computer or Windows NT Explorer to remove media while Windows NT is running. When pointing at the device, click the right mouse button. If the media can be ejected, the Eject command is available. If there is no Eject command in the menu, or the command is grayed, you cannot eject the media.

Note: WORM and other types of "Write once" media are not supported in Windows NT.

There are several limitations that are unique to removable media in Windows NT.

• Removable media can only have a single primary partition. Extended partitions are not supported.

• Removable media devices cannot be used as part of a volume set, stripe set, mirror set, or stripe set with parity.

• It is not possible to format a floppy disk with the NTFS file system. The Windows NT operating system formats all floppy disks with the FAT file system, because the additional files required for the NTFS file system use too much space on a floppy disk.

• If you format a removable disk with the FAT file system, you can remove the disk while Windows NT is running.

• When you format any removable disk with the NTFS file system, or if the page file is located on removable media, you can only remove the disk after you shutdown Windows NT.

Windows NT File Systems

This section contains information about the two file systems that Windows NT supports:

• File Allocation Table (FAT). The computer can access files on a FAT volume when it is running Windows NT, Windows 95, MS-DOS, or OS/2.

• Windows NT File System (NTFS). The computer must be running Windows NT to be able to access files on an NTFS volume.

The FAT file system is a simple file system originally designed for small disks and simple folder structures. The FAT file system is named for its method of organization, the file allocation table, which resides at the beginning of the volume. To protect the volume, two copies of the table are kept, in case one becomes damaged. In addition, the file allocation tables and the root folder must be stored in a fixed location so that the files needed to start the system can be correctly located.

The FAT file system works the same in Windows NT as it does in MS-DOS, Windows 3.1x, and Windows 95. In fact, you can install Windows NT on your existing FAT primary partition. When running Windows NT, you can move or copy files between FAT and NTFS volumes.

Note: You cannot use Windows NT with any compression or partitioning software that requires disk device drivers to be loaded by MS-DOS. Therefore, you cannot use MS-DOS 6.0 DoubleSpace or MS-DOS 6.22 DiskSpace on a FAT primary partition or logical drive that you want to access when running Windows NT.

The Windows NT file system (NTFS) provides a combination of performance, reliability, and compatibility not found in the FAT file system. It is designed to quickly perform standard file operations such as read, write, and search — and even advanced operations such as file-system recovery — on very large hard disks.

The NTFS file system includes security features required for file servers and high-end personal computers in a corporate environment. The NTFS file system supports data access control and ownership privileges that are important for the integrity of critical data. While folders shared on a Windows NT computer are assigned particular permissions, NTFS files and folders can have permissions assigned whether they are shared or not. NTFS is the only file system on Windows NT that allows you to assign permissions to individual files. However, when you move or copy a file from an NTFS to a FAT volume, permissions and other attributes unique to the NTFS file system are lost.

You can use either or both of these file systems on a computer. Which one you choose for your computer, or for an individual volume on your computer, depends on such things as:

• How you expect to use the computer.

• The hardware platform.

• The size and number of hard disks.

• Security considerations.

For more information about file systems, especially NTFS, see Inside the Windows NT File System, by Helen Custer (Microsoft Press 1994, ISBN 1-55615-660-X), which documents the NTFS file system design.

Maximum Sizes

The maximum file size and volume size for the FAT file system is 232 bytes (4 GBs). FAT can support a maximum of 65,535 clusters per volume.

The NTFS architecture is designed to use numbers up to 264 bytes (16 exabytes, or 18,446,744,073,709,551,616 bytes). In theory, it is possible to have a volume 264 bytes in size. Even if there were hardware available to supply a logical volume of that capacity, there are other limitations to the maximum size of a volume.

Partition Tables are limited by industry standards to 232 sectors. (For more information about Partition Tables, see the earlier sections titled "Partition Table" and "Using Hard Disks With More Than 1024 Cylinders (x86-based Computers)."

The sector size is a function of hardware and industry standards, and is normally 512 bytes. While sector sizes might increase in the future, the current size puts a limit on a single volume of 2 terabytes (232 * 512 bytes, or 241 bytes ).

Windows NT provides the capability to combine discontiguous disk areas when creating volume sets, stripe sets, and stripe sets with parity, but these volumes have the same limitations. Even if there were physical disks with 2 terabyte (TB) capacity, they could not be combined to create larger volumes without increasing the physical sector size.

There is one case where you can combine disks that exceed the 2 TB limit. In Disk Administrator, there is an option to extend a volume set. You do this by selecting an existing primary partition, logical drive, or volume set that is already formatted as NTFS. You can then combine it with one or more areas of free space and select Extend Volume Set from the Partition menu. You end up with a larger NTFS volume set. However, if anything goes wrong with a volume set larger than 2 TB, you cannot just reformat it. You must again start with a smaller volume set (<=2 TB) and use the Extend Volume Set selection to extend the volume set to larger that 2 TB.

For the time being, 2 TB should be considered the practical limit for both physical and logical volumes using NTFS.

With the NTFS file system, you can have a maximum of 232 clusters per file. This is an implementation limitation, not a file size restriction.

There is no specific limit to the number of files on an NTFS volume. However, you will not be able to create any new files when your volume is so full that Windows NT cannot allocate another entry in the MFT.

Which File System to Use on Which Volumes

This is a general recommendation for determining which file systems to use for which volumes:

• Use a small FAT primary partition (between 250 and 500 MB, depending on the total disk space and page file size) as the C drive. Use this partition for both your system and boot partition.

• Format the rest of your disk space as NTFS, and use the NTFS volumes for application programs and data. You might want to create more than one NTFS volume.

This arrangement gives you the following benefits:

• You have the recoverability of the NTFS file system for the most important information, your data. (You should always maintain your system and boot partitions by using backup tapes and creating an Emergency Repair Disk, as described in Chapter 5, "Preparing for and Performing Recovery.")

• FAT is more efficient for smaller volumes and NTFS is more efficient for larger volumes.

• NTFS provides file and folder security for your application programs and data.

• If you have a startup failure on an x86-based computer, this means that you can start up the computer with an MS-DOS bootable floppy disk to troubleshoot and recover from the problem.

These additional guidelines might affect your decision as to which file system(s) to use on your computers:

• For an x86-based computer, when Windows NT starts up, it looks for certain files in the root folder of the hard disk that contains the system partition. This partition can be formatted with either the NTFS or FAT file system. This partition should be large enough to accommodate all the files you need to access under that file system.

• For a RISC-based computer, the system partition must be formatted with the FAT file system. You can use the NTFS file system on your boot partition, which needs to be large enough for all Windows NT system components. If you configure your partitions in this way, your system partition should be 5-10 MB, and your boot partition should be at least 160 MB, 250-500 MB to allow for growth.

• Because you must format your system partition with the FAT file system on RISC-based computers, you can use Disk Administrator to secure the system partition. This prevents anyone who does not have administrative privileges from accessing the system partition in spite of the fact that it is formatted as FAT. See online Help for the Disk Administrator for more information.

Note: The system partition contains the Partition Boot Sector and other files needed to load the operating system, such as NTLDR (for x86-based computers) and OSLOADER (for RISC-based computers). The boot partition needs to include the folder with the operating system. The boot partition and the system partition can be a single partition with other folders in it.

Controlling Access to Files and Folders

On NTFS volumes, you can set permissions on files and folders that specify which groups and users have access to them, and what level of access is permitted. NTFS file and folder permissions apply both to users working at the computer where the file is stored and to users accessing the file over the network when the file is in a shared folder. With NTFS you can also set share permissions, which operate on shared folders in combination with file and folder permissions.

Note: To preserve permissions when you copy or move files between NTFS folders, use the Scopy program on the Windows NT Server Resource Kit CD.

With FAT volumes, you cannot set any permissions on the individual files and folders. The only security is share permissions that are set on the entire share, affect all files and folders on that share, and only function over the network. Once a folder is shared, you can protect the shared folder by specifying one set of share permissions that applies to users for all files and subfolders of the shared folder. Share permissions are set in very much the same way as file and folder permissions are set in NTFS. But because share permissions apply globally to all files and folders in the share, they are significantly less versatile than the file and folder permissions used for NTFS volumes.

Share permissions apply equally to NTFS and FAT volumes. They are enforced by Windows NT, not the individual file system.

Chapter 4, "Managing Shared Resources and Resource Security," in the Windows NT ServerConcepts and Planning book, contains several sections that describe setting and using file and folder permissions on FAT and NTFS volumes.

NTFS Compression

Windows NT supports compression on an individual file basis for NTFS volumes. Files that are compressed on an NTFS volume can be read and written by any Windows-based application without first being decompressed by another program. Uncompression happens automatically during the read of the file. The file is compressed again when it is closed or explicitly saved.

Compressed files and folders have an attribute of C when viewed in My Computer or Windows NT Explorer. You can select an alternate color for compressed files and folders by:

• On the View menu, click Options.

• On the View tab, check Display compressed files and folders with alternate color.

Only the NTFS file system can read the compressed form of the data. When an application like Microsoft Word for Windows or an operating system command like Copy requests access to the file, the NTFS file system uncompresses the file before making it available. For example, if you copy a compressed file from a another Windows NT computer to a compressed folder on your hard disk, the file will be uncompressed, copied, and recompressed.

This compression algorithm is similar to that provided by the MS-DOS 6.0 DoubleSpace and MS-DOS 6.22 DriveSpace compression, with one important difference — the MS-DOS functionality compresses the entire volume, while the NTFS file system enables the user to compress individual files and folders in the NTFS volume.

NTFS compression is not supported for cluster sizes larger than 4K, because

• Compression causes a performance degradation.

• The reason you use very large (>4K) clusters is to improve performance in some special cases.

Therefore, you should not use compression and large clusters at the same time. In other words, compression performs reasonably well on sizes up to 4K, but beyond that size, the savings in disk space is not worth the decrease in performance. When the cluster size is >4K on an NTFS volume, none of the NTFS compression functions are available.

Other compression utilities are available to compress files on computers running Windows NT. These utilities differ from NTFS compression in the following ways:

• They usually can be run only from the command line.

• Files cannot be opened when they are in a compressed state — the file must first be uncompressed by using the companion program to the one used to compress the file. When you close the file, it is saved in an uncompressed state, and you have to use a program to compress it.

The Windows NT Server Resource Kit includes a compress program and an expand program. These compress program can only be run from the command line. The expand program is a Windows-based application. There is also an expand program on the Windows NT Server product CD, which you need to run from the command line. For more information about these utilities, see "File System Utilities" in Chapter 10, "Disk, File System, and Backup Utilities."

As described earlier, the DoubleSpace and DriveSpace compression features in MS-DOS cannot be used when running Windows NT.

NTFS Recoverability

A lazy-write file system, such as the FAT file system when running Windows NT, uses an intelligent cache-management strategy and provides a way to recover data (such as the Chkdsk program) if there is an error when writing to the disk. All data are accessed via the file cache. While the user searches folders or reads files, data to be written to disk accumulates in the file cache. If the same data are modified several times, all those modifications are captured in the file cache. The result is that the file system needs to write to disk only once to update the data.

NTFS is recoverable file system. It combines the speed of a lazy-write file system with virtually instant recovery.

The NTFS file system guarantees the consistency of the volume by using standard transaction logging and recovery techniques, although it doesn't guarantee the protection of user data. It includes a lazy-write technique plus a volume-recovery technique that takes typically only a second or two to insure the integrity of all NTFS volumes each time the computer is restarted.

Effects of File and Disk Cache on Recoverability

The file cache is just an area of RAM that contains the data. When you write data to disk, Windows NT's lazy-write technique says that the data are written, when, in fact, they are still in RAM.

There can also be cache memory on the disk controller or on the disk itself. If you are running MS-DOS or Windows 3.1x, using the disk or controller cache can really help performance. Windows NT's use of the lazy-write technique improves performance to the point where you might not see much more improvement by using the cache on the disk or the controller.

This information should help you decide whether you want to enable the disk or controller cache:

• If disk performance is an issue, and specifically if the disk is being heavily written, turning on write caching is an option for improving performance, especially if it can be measured to improve the performance of the system.

• Controlling the write-back cache is a firmware function provided by the disk manufacturer. See the documentation supplied with the disk. You cannot configure the write cache from Windows NT.

• Write caching does not impact the reliability of the file system's own structures (metadata). NTFS instructs the disk device driver to insure that metadata writes get written through regardless of whether write caching is enabled or not. Non-metadata is written to the disk normally, so caching can occur for such data.

• Read caching in the disk has no impact on file system reliability.

Automatic Recovery from Disk Errors

This section discusses how Windows NT automatically recovers from some kinds of disk errors. You do not even know that an error occurred.

Windows NT provides two kinds of disk error recovery:

• Dynamic data recovery by using sector sparing, which is only available on SCSI disks that are configured as part of a fault-tolerant volume. Sector sparing works on fault-tolerant volumes because a copy of the data on the sector with the error can be regenerated.

• NTFS cluster remapping.

Windows NT Server provides additional recovery mechanisms for fault-tolerant volumes (mirror sets and stripe sets with parity). For more information about fault-tolerant volumes, see Chapter 5, "Preparing for and Performing Recovery."

The following table summarizes what happens if a sector goes bad on a computer running Windows NT Server. There is more information about sector sparing and cluster remapping following the table. For more details, see Chapter 5, "Volume Management and Fault Tolerance" in the book Inside the Windows NT File System.

Description	FtDisk installed with a SCSI disk that has spare sectors	FtDisk installed with a non-SCSI disk or disk with no spare sectors	FtDisk not installed with any kind of disk
Fault-tolerant volume (Windows NT Server only)	1. FtDisk recovers the data. 2. FtDisk replaces the bad sector. 3. File system doesn't know about the error.	1. FtDisk recovers the data. 2. FtDisk sends the data and bad-sector error to the file system. 3. NTFS performs cluster remapping. 4. FAT doesn't do anything about the error.	N/A
Non-fault-tolerant volume	1. FtDisk can't recover the data. 2. FtDisk sends a bad-sector error to the file system. 3. NTFS performs cluster remapping. On a read operation, data are lost. 4. FAT loses the data on both read and write.	1. FtDisk can't recover the data. 2. FtDisk sends a bad-sector error to the file system. 3. NTFS performs cluster remapping. On a read operation, data are lost. 4. FAT loses the data on both read and write.	1. Disk driver returns a bad-sector error to the file system. 2. NTFS performs cluster remapping. On a read operation, data are lost. 3. FAT loses the data on both read and write.

Note: FtDisk is the device driver that handles I/O to volume sets, stripe sets, mirror sets, and stripe sets with parity. However, volume sets and stripe sets are not fault tolerant, so processing of an error on one of these volumes falls into the non-fault-tolerant volume category.

Sector Sparing

If a disk read error occurs on a file on a fault-tolerant volume on a hard disk connected to a SCSI controller, Windows NT Server uses a technique called sector sparing to recover the data. Windows NT Server obtains a spare sector from the disk device driver to replace the bad sector. It then recovers the data by reading the sector from the mirror disk or recalculating the data from a stripe set with parity, and writes the data to the new sector.

This processing is transparent to any applications performing disk I/O. Sector sparing eliminates error messages such as the "Abort, Retry, or Fail?" that occur when a file system encounters a bad sector.

Cluster Remapping

With transaction logging and recovery, NTFS guarantees that the volume structure will not be corrupted, so all files remain accessible after a system crash. However, user data can be lost because of a system crash or a bad sector.

The NTFS file system implements a recovery technique called cluster remapping. When Windows NT returns a bad sector error to the NTFS file system, NTFS dynamically replaces the cluster containing the bad sector and allocates a new cluster for the data. If the error occurred during a read on a non-fault-tolerant volume, NTFS returns a read error to the calling program, and the data are lost. When the error occurs during a write, NTFS writes the data to the new cluster, and no data are lost.

NTFS puts the address of the cluster containing the bad sector in its Bad Cluster File so the bad sector will not be reused.

Using MS-DOS-based Disk Utilities

Do not use any third-party MS-DOS-based disk program to repair or defragment a FAT volume used by Windows NT unless the disk program has been certified as being compatible with Windows NT version 3.5 or later. While instances of third-party utilities corrupting FAT volumes are relatively rare, some problems have occurred. Using non-Windows NT utilities are simply not worth the risk of losing an entire volume. Even the MS-DOS-based program Defrag might not work correctly if you have long filenames in the FAT volume.

You can use the Windows NT command prompt program Chkdsk to scan and repair FAT and NTFS volumes. This program incorporates all of the functionality of the MS-DOS-based Chkdsk and Scandisk utilities, including a surface scan. To do a surface scan, use chkdsk /r.

There is a Windows NT-based program available that can defragment both FAT and NTFS volumes. Microsoft has a directory that contains information about hardware and software programs that are available for Windows NT, including defragmentation utilities. This directory is called InfoSource. For information about InfoSource, see http://www.microsoft.com/infosource.

Disk media verification can be done with the SCSI utilities that ship with most SCSI controllers. Consult the documentation accompanying your hardware or contact your hardware vendor for information on verification of disk media. It is always a good idea to do a complete backup of the disk before starting a procedure of this type.

Generating and Viewing Short Filenames

Filenames on Windows NT platforms can be up to 256 characters, and can contain spaces, multiple periods, and special characters that are illegal in MS-DOS filenames. These long filenames use the 16-bit Unicode character set. Windows NT makes it possible to access files with long names from other operating systems by automatically generating an MS-DOS – readable (eight-plus-three) name for each file. This way, files are accessible over a network by computers using the MS-DOS, Windows 3.1x, and OS/2 operating systems, as well as by computers using Windows NT and Windows 95 operating systems. When an application saves a file on a computer running Windows NT, both the eight-plus-three filename and long filename are retained.

Note: Use caution with MS-DOS-based or Windows 3.x-based applications when running under Windows NT. With these applications, if you save a file to a temporary file, delete the original file, and rename the temporary file to the original filename, the long filename is lost. Any unique permissions set on that file are also lost.

If the long name of a file or folder contains spaces, be sure to surround the name with quotation marks. For example, if you have a program called DUMP DISK FILES that you want to run from the Start icon and you enter the name without quotation marks, you will get an error message that says "cannot find the program DUMP or one of its components."

You must also use quotation marks when a path typed at the command line includes spaces, as in the following example:

move "c:\This month's reports\*.*" "c:\Last month's reports"

Note: Use wildcards such as * and ? carefully in conjunction with the del and copy command prompt commands. Windows NT searches both long and short filenames for matches to the wildcard combination you specify, which can cause extra files to be deleted or copied.

To copy or move files with case-sensitive long filenames, it is safest to select the files using a mouse in Windows NT Explorer and My Computer. That way, you can clearly identify which files you want to copy or move.

Because both the FAT file system and the NTFS file system use the Unicode character set for their names, there are several illegal characters that MS-DOS cannot read in any filename. To generate a short MS-DOS – readable filename for a file, Windows NT deletes all of these characters from the long filename and removes any spaces. Since an MS-DOS-readable filename can have only one period, Windows NT also removes all extra periods from the filename. Next, Windows NT truncates the filename, if necessary, to six characters and appends a tilde (~) and a number. For example, each nonduplicate filename is appended with ~1. Duplicate filenames end with ~2, ~3, and so on. Filename extensions are truncated to three or fewer characters. Finally, when displaying filenames at the command line, Windows NT translates all characters in the filename and extension to uppercase.

When there are five or more files that would result in duplicate short filenames, Windows NT uses a slightly different method for creating short filenames. For the fifth and subsequent files, Windows NT:

• Uses only the first two letters of the long filename.

• Generates the next four letters of the short filename by mathematically manipulating the remaining letters of the long filename.

• Appends ~1 (or another number, if necessary, to avoid a duplicate filename) to the result.

This method provides substantially improved performance when Windows NT must create short filenames for a large number of files with similar long filenames. Windows NT uses this method to create short filenames for both FAT and NTFS volumes.

For example, these are the long and short filenames for six files that you create in the order test 1 through test 6.

Long filename	Short filename
This is test 1.txt	THISIS~1.TXT
This is test 2.txt	THISIS~2.TXT
This is test 3.txt	THISIS~3.TXT
This is test 4.txt	THISIS~4.TXT
This is test 5.txt	TH0FF9~1.TXT
This is test 6.txt	THFEF5~1.TXT

However, when you create the files in the order shown in this table, you get the following short filenames.

Long filename	Short filename
This is test 2.txt	THISIS~1.txt
This is test 3.txt	THISIS~2.txt
This is test 1.txt	THISIS~3.txt
This is test 4.txt	THISIS~4.txt
This is test 5.txt	TH0FF9~1.txt
This is test 6.txt	THFEF5~1.txt

Windows NT displays the long names for folders and files. You can use Windows NT Explorer and My Computer to see the short name by selecting the file or folder and selecting Properties on the File menu.

From the command line, to see both the long and short filenames for each file in the folder, type the following command:

dir /x

Tip To display both long and short filenames automatically when using the dir command, use the System option in Control Panel to set the dircmd variable to the value /x.