Active Partition - on systems with BIOS firmware the boot device (assuming it is a hard disk type device) can have one (and only one) Partition marked as ACTIVE in the Partition Table - the Volume Boot Record (VBR) on this active partition will be loaded as part of the boot process, on Windows NT 6.* systems code in the VBR will then load the Windows Boot Manager (bootmgr). Assuming a default setup is used the Active Partition will contain bootmgr (at the Drive Root) and the BCD file (\Boot\BCD).
Batch file - a script that contains a list of commands to be executed by the commandline interpreter - cmd.exe is the default commandline interpreter in Windows NT systems. Batch files can be used to automate tasks - in particular running commandline applications.
BCD - Boot Configuration Data file. The file containing boot menu options and settings used in Windows NT 6.* systems. This is a binary file that uses the same format as Windows Registry Hives. BCD replaced boot.ini - the (plain text) boot configuration file used on previous versions of Windows NT up to NT 5.*. Menu options (Objects) are chainloaded when selected by the user.
bcdedit.exe - commandline tool used to create or modify BCD stores.
BIOS - Basic Input/Output System. A firmware type used on computer systems containing code which is executed when the device is switched on or (re)booted - prior to any operating system being loaded.
Boot - the process initiated when the system is powered on or reset. Loads and executes code required to load an Operating System.
Boot Device - the device containing the volume in which the boot manager or Operating System loader used to load the (running) operating system resides. This could be a hard disk, USB disk, Floppy Disk, CD/DVD, etc.
bootmgr - the Windows boot manager on systems with BIOS firmware. This file will be loaded as part of the BIOS boot process - typically the boot device is set in the BIOS. Assuming the boot device is a hard disk type device then the Master Boot Record is loaded > the Active Partition is identified in the Partition Table > the Partition Boot Record (PBR) on the Active Partition is loaded > code in the PBR loads bootmgr > bootmgr loads the BCD file.
bootmgfw.efi - the Windows boot manager on systems with UEFI firmware. This file is loaded directly from the Windows Boot Manager entry in the Firmware Boot Menu stored in NVRAM. Typical boot process is Firmware Boot Manager > \EFI\Microsoft\boot\bootmgfw.efi on the EFI System Partition is loaded via the Windows Boot Manager entry > bootmgfw.efi loads the BCD file (path to BCD file - \EFI\Microsoft\boot\BCD).
Boot Manager - a utility that allows multiple operating systems to be loaded. On Windows NT 6.* systems the Windows Boot Manager is bootmgr (BIOS) or bootmgfw.efi (UEFI). bootmgr and bootmgfw.efi function as both boot manager and boot loader (OS loader).
Boot Sector - the start of a Partition containing the machine code that will continue the Boot process. See also Volume Boot Record.
Boot Sequence (BIOS) - the Windows NT 6.* boot sequence on
BIOS systems: BIOS code is loaded and executed > MBR code is loaded and executed > PBR/VBR code is executed > Boot Manager code is executed > BCD file is loaded > Object is selected from the boot menu (user selected or default entry) > OS loader code is executed > OS is loaded.
Boot Sequence (UEFI) -
the Windows NT 6.* boot sequence on
UEFI systems: UEFI code is loaded and executed > Windows Boot Manager is executed (via entry in the Firmware Boot Menu) > BCD file is loaded > Object is selected from the boot menu (user selected or default entry) > OS loader code is executed > OS is loaded.
Boot Volume - the Volume or Partition that contains the Boot Manager. On MBR type disks this will be the Active partition. Please note that Microsoft confusingly refers to the boot volume as the "System" volume and the operating system volume as the "boot" volume - see http://www.multibooters.co.uk/system.html. Please refer also to the Disk Management screenshots in the Default Paths/Setup (BIOS) section of these notes - as you can see from these screenshots the same volume can be both "system" and "boot".
Bytes (binary) - disk space as reported by the operating system is usually in binary byte units where units use a number base of 2 - they are multiples of 2. 1024 bytes for example is equal to 210 and is commonly abbreviated as 1 KB. Unfortunately the abbreviations commonly used by operating systems including Windows (e.g. KB, MB, GB, etc.) can be misleading as the same abbreviations are used for Decimal Bytes - which use a different number base (10). Although Windows and some other operating systems may continue to use decimal terms and abbreviations, binary byte values can be more accurately differentiated from decimal bytes using the following abbreviations -
Bytes (decimal) - see also Bytes (binary). Decimal bytes use a number base of 10 - they are multiples of 10. Unfortunately hard disk manufacturers tend to refer to decimal bytes in regards to hard disk capacities, whereas Windows refers to binary bytes, but use the same (decimal) abbreviations. This can lead to significant discrepancies between manufacturer specified disk capacities and those reported by Windows. Taking a 1 (decimal) TB hard disk as an example, the disk will contain 1000000000000 bytes (10004) or 1000 (decimal) GB. Windows will report this same disk as having a capacity of approximately 931 (binary) GB - or more accurately 931 GiB. Decimal byte abbreviations -
Chainloading - the operating system boot process is completed by loading machine code parts in one area of the system, then passing control to a different area/device by (chain)loading the next element in the chain - e.g. machine code in the MBR loads the PBR/VBR > code in the PBR/VBR (chain)loads the boot manager > boot manager (chain)loads the Boot Loader > etc. Each subsequent part in the boot process is chainloaded by the one proceeding it in a given sequence until the Operating System is fully loaded.
Commandline - a text based interface for inputting commands manually to the commandline interpreter - cmd.exe is the default commandline interpreter in Windows NT systems. Commands are typed line by line or can often be automated using a batch file.
Data - in the scope of this guide, data refers to the settings in individual Elements in a BCD store. The most commonly used data types are listed here. More generically, "Data" refers to areas that are not code but rather settings or information.
Device - this has two meanings in the scope of these notes. A device can be a physical device (e.g. a hard disk drive) or a device type as understood by bcdedit.exe (e.g. Locate, Boot, Partition, etc. - see here)
Disk - in the scope of this guide a disk refers to a partition type storage device. The term disk refers to the whole of a device (including the Master Boot Record, the hidden sectors between the MBR and the first partition, and any other sectors not contained within partition boundaries) and is not to be confused with individual Partitions or Volumes - which are assigned mount points (drive letters) in Windows. A disk for example may contain multiple partitions whilst a drive refers to only one partition on the disk.
Disk Signature - a four byte string used to identify MBR disks in Windows NT systems. The disk signature is contained in the MBR (SectorLBA0) at hex offset 0x01B8.
The disk signature is used to identify the disk during the early phase of the Boot process and later becomes part of the mechanism used to assign Mount Points (drive letters) to Volumes. Any disk without a disk signature (all 00's from hex offset 0x01B8 to 0x01BB) will have one automatically written if attached to a Windows NT system. In the unlikely event that two disks with the same disk signature are attached to the same Windows NT system, one of the disks will have its signature changed automatically to avoid conflicts. Note - Disk Signatures are randomly assigned, the chance of identical disk signatures on the same system are highly unlikely unless a disk has been cloned.
Drive - refers to a physical Device if the media is non-partitioned (e.g. a floppy disk). On a partition type storage device (e.g. a hard disk), drive refers to an individual partition - not the whole disk. On partition type devices, the terms Drive and Volume and Partition (excluding Extended Partitions) are interchangeable in the scope of these notes. In terms of non-partitioned storage media, the term drive refers to the whole device.
Drive Letter - the Mount Point used in Windows in order to access a storage device - e.g. Drive C: is the default mount point for the volume containing the running operating system. On partition type storage devices such as hard disks a drive letter is assigned to an individual volume - each volume on a hard disk containing a supported File System will be automatically assigned a separate drive letter, with the exception of certain "special" volumes that are excluded by default. It's not possible to access the Master Boot Record via a mount point as this is located before and outside of any volumes. On non-partition type storage devices the entire contents of the device will be accessible via one drive letter.
Drive Root - the base directory of a drive. The root of drive C: for example refers to any files or folders in the base directory of drive C:. Expanding on this, the file "C:\bootmgr" and the folder/directory "C:\boot" are both contained at the drive root. The file "C:\Boot\BCD" is not as it's contained in the "C:\Boot" directory.
EFI System Partition - also referred to as ESP and EFIsys. The EFI System Partition is the boot Partition on GPT type disks. Used on systems with UEFIFirmware to store Boot Manager programs. On Windows systems the EFI System Partition is the location of the Windows Boot Manager (bootmgfw.efi) and the BCD Store.
Element - a container within an Object in a BCD store. The hierarchy in a BCD store is Store > Object(s) > Element(s) > Data. Each BCD store can contain multiple objects, each object can contain multiple elements, each element contains data.
Extended Partition - a type of Partition on MBR Disks. MBR Disks are limited to a maximum of four partitions due to size restrictions in the Partition Table - this previously limited hard disks to a maximum of four volumes/drives. An extended partition overcomes this limit as it can be further subdivided into multiple Logical Drives - increasing the number of drives each disk can contain. MBR Disks can contain only one extended partition. It's not possible to boot from an Extended Partition or the Logical Drives within it.
File System - the method used to allocate space and organise and index files and directories on devices so that they are accessible and retrievable. The most commonly used file systems on Windows devices are NTFS (the NT File System) and FAT (File Allocation Table).
Firmware - "Firmware is a software program or set of instructions programmed on a hardware device. It provides the necessary instructions for how the device communicates with the other computer hardware." - http://techterms.com. The Firmware is stored on an internal chip, usually an EEPROM or Flash of limited capacity, which can only be modified or upgraded using a tool from the motherboard manufacturer.
GPT Header - a Sector on a GPT Disk - usually sector LBA1 with a backup copy in the last addressable sector of the disk. The GPT header contains information including the (unique) disk GUID, a checksum for the partition table, number of partitions, location (LBA) of this GPT header, location (LBA) of the alternate (backup) GPT header, etc.
GPT Partition Scheme - (aka GPT Disk). A GUID Partition Table is a way of partitioning/dividing a storage device. A GPT Disk contains a Protective MBR located in the very first Sector of the device (LBA0). Sector LBA1 contains the GPT header. The partition entries follow the GPT header - each partition entry is 128 bytes in length so a 512 byte sector contains up to four partition entries.
Assuming a sector size of 512 bytes, Sectors LBA2 to LBA33 are reserved for partition entries for up to 128 partitions (32 sectors x 4 partition entries per sector = 128 partitions).
The GPT header and partition entries are duplicated in inverted order at the end of the disk - the duplicate GPT header is in sector LBA -1 where the negative value is the relative position from the end of the disk (with LBA -1 being the last addressable sector). Partition entries are in sectors LBA -2 to LBA -33.
GPT disks do not contain Extended Partitions or Logical Volumes - all partitions are Primary. For more information about GPT disks see here.
GUID - Globally UniqueIDentifier. This has two meanings in the scope of these notes. GUID can refer to an Object in a BCD store, or a unique disk/partition ID on a GPT partition type disk. A GUID is a 16 bytes long hex number - e.g. C12A7328F81F11D2BA4B00A0C93EC93B. GUID values are often represented in groups of 4-2-2-2-6 digits separated by a hyphen and enclosed in {} type brackets - e.g. {C12A7328-F81F-11D2-BA4B-00A0C93EC93B}.
Hard Disk - Also referred to as a Hard Disk Drive (HDD) or Hard Drive. A Hard Disk is a partitioned data storage device. In the scope of this guide the term Hard Disk can also refer to Solid State Drives (SSD's) or to other flash memory based devices such as SD cards or USB sticks. Hard Disks are block type devices - each block (or Sector) can store a fixed number of bytes. Hard Disks are partitionable media. One of two partitioning schemes are used - GPT and MBR.
Hard Disk Capacity Limitations - as disks have increased in capacity, the BIOS and Partition Table have evolved to overcome limitations imposed by earlier designs. Prior to the introduction of Logical Block Addressing, Cylinder-Head-Sector (CHS) addressing was used to index Sectors. As hard disk capacities became greater than the size the Firmware was able to address, new methods were implemented in order to ensure that the full capacity of the disk could actually be used. The maximum number of sectors addressable using CHS is 16450560 (1024 cylinder x 255 heads x 63 sectors) - assuming a sector size of 512 bytes the maximum disk capacity using CHS addressing is 7.84 GiB. Initial implementations of LBA used 28-bit LBA allowing for a maximum of 0xFFFFFFF (268435456) sectors - or 128 GiB with a 512 byte sector size. 32-bit LBA overcame this limit and is able to address up to 0xFFFFFFFF (4294967296) sectors - 2 TiB assuming a sector size of 512 bytes. If a larger sector size is used then it's possible to address space greater than 2 TiB using 32-bit LBA IF this is supported by the operating system. A sector size of 4096 bytes for example would allow disks as large as 16 TiB to be addressed. Windows NT 6.* systems cannot boot from disks with sectors larger than 512 bytes, however they can use these disks for storage purposes. The current 32-bit LBA limitation is actually due to the structure of the existing Master Boot Record (MBR) and Partition Table. Were support for 48-bit LBA fully implemented in the Operating System and the system Firmware then it would be possible to address up to 0xFFFFFFFFFFFF (281474976710656) sectors. Assuming a sector size of 512 bytes this would equate to 128 PiB (131072 TiB). Current restrictions on limiting Windows NT 6.* to booting from MBR disks up to a maximum of 2 TiB are therefore artificially imposed due to the decision not to implement support for booting on disks with sectors larger than 512 bytes and not fully implementing 48-bit LBA.
Initialize(d) disk - an initialized hard disk will contain the byte sequence 55AA at hex offset 0x01FE in the Master Boot Record (MBR) - SectorLBA0. If this byte sequence is missing, Windows will prompt to "initialize disk" if its accessed in Disk Management. When a hard disk is initialized in Windows a MBR will be written to LBA0, a Disk Signature will be written to the MBR and the Magic Bytes 55AA will be written at hex offset 0x01FE.
Logical Block Addressing (LBA) - a scheme used to specify the location of blocks of data (sectors) on hard disks. The LBA scheme specifies the location as an offset from the start of a device - LBA0 for example is the first sector of a device. This offset value is used in the Partition Table in conjunction with a value for the size of a partition (i.e. the number of sectors in a partition). Logical Block Addressing is used in both MBR and GPT type disks - the difference being in the bit size. MBR disks use 32-bit (or 4 byte) values for partition offset and size - e.g. FFFFFFFF. GPT disks use 64-bit (or 8 byte) values - e.g. FFFFFFFFFFFFFFFF. See also Hard Disk Capacity Limitations.
Logical Drive - or Logical Volume. A container within an Extended Partition on MBR Disks. A logical drive will be allocated its own Mount Point and is normally assigned a drive letter, however it is not a separate partition - it's a volume (of space), with its own File System, within a partition.
Master Boot Record (MBR) - the first sector of a hard disk (Sector LBA0) on disks that use the MBR partition scheme. This sector contains the partition table and machine code used to start the next stage of the boot process. GPT disks also contain a MBR at sector LBA0, a Protective MBR, however this is not used during the boot process on UEFI systems.
MBR Partition Scheme - (aka MBR Disk) a way of partitioning/dividing a storage device. MBR type disks contain a Master Boot Record (MBR) located in the very first Sector of the device (LBA0). The MBR contains machine code for loading the Volume Boot Record on the partition marked as Active in the Partition Table . MBR disks can contain a maximum of four partitions. One of these can be an Extended Partition, which can be further divided into Logical Drives. For more information see here.
Mount Point - For a drive to be accessible in an operating system it usually needs to be mounted. Windows systems will by default automatically mount any drives that contain a known (to Windows) File System unless the drive uses a hidden file system type.
On BIOS systems the Active Partition will not automatically be allocated a mount point on Windows NT 6.* systems unless it also contains the operating system files. On UEFI systems the EFI System Partition will not automatically be allocated a mount point. Windows systems use Drive Letters as mount points.
Multiboot - A system with more than one operating system. A Boot Manager is therefore required to select which operating system to boot.
NVRAM - Non-volatile Random-access Memory. A writable area of memory that stores settings even when a system is powered off. On UEFI systems the Firmware Boot Menu is stored in NVRAM.
Partition - a means of dividing available space on some types of storage devices. A Hard Disk type device can contain multiple partitions - each partition (with the exception of
Extended Partitions) can be formatted with a different File System. A Drive Letter on Windows Systems is used for each accessible partition - or to be more exact all Volumes are automatically allocated a drive letter when mounted. Partitions are particularly useful as a means of keeping operating system files and user data separate. They are also useful in Multiboot systems as each operating system can be installed to individual partitions - keeping their settings and files separate.
Partition Boot Record - or PBR. The start of a partition that contains machine mode that will continue the boot process. See also Volume Boot Record.
Partition Table (MBR) - applies to hard disks formatted using the MBR partition scheme. The partition table is a section in the
Master Boot Record that contains settings for the partition structure on the disk. The partition table can contain up to a maximum of four entries for primary and (a maximum of one) extended partitions. Information stored in the partition table includes File System type, offset (sectors in LBA) and size (sectors in LBA) and whether the partition is marked as active. The partition table also specifies partition offsets in CHS values, however these are obsolete on modern disk drives as they can only address up to 1024*255*63 (or 16450560) sectors (approximately 7.84 GiB assuming a sector size of 512 bytes). As disks have increased in capacity, the BIOS and Partition Table have evolved to overcome limitations imposed by earlier designs. Please refer to Hard Disk Capacity Limitations for more details.
Partition Table (GPT) - applies to hard disks formatted using the GPT partition scheme. Unlike MBR Disks, the partition table spans multiple sectors. Windows limits the number of partitions to 128 on GPT disks - the EFI specification supports more - 128 is the minimum number. Each partition entry in the partition table is 128 bytes long. Assuming a 512 byte Sector size each sector contains 4 partition entries. Sectors LBA2 to LBA33 are consequently reserved for partition entries (32 (sectors) multiplied by 4 (entries per sector) = 128 partitions). See also GPT Partition Scheme.
Primary Partition - a type of Partition on MBR Disks. MBR Disks can contain a maximum of 4 primary partitions or up 3 primary partitions and 1 Extended Partition (which can be sub-divided into multiple Logical Volumes).
Protective MBR - GPT disks contain a protective MBR at SectorLBA0. Unlike MBR Disks, the protective MBR is not actually used during the boot process and appears to have been implemented for legacy support - it's purpose is to prevent non-GPT aware operating systems and tools from accidentally writing to the disk. To comply with the UEFI Specification the protective MBR should not contain a Disk Signature and the Partition Table should contain only one entry for a partition that spans the whole of the disk starting from sector LBA1. Windows is not fully compliant with the UEFI specification as the partition size is set to the maximum 32-bit LBA size irrespective of the actual size of the disk - 0xFFFFFFFF (4294967296) sectors. The partition type is set as 0xEE.
Sector - a block or unit on a hard disk. A hard disk is made up of individual blocks that each contain a fixed number of bytes. A sector is usually 512 bytes, but can be larger - the sector size on some modern hard disks is 4kb (4096 bytes). On systems with UEFI or BIOSFirmware a sector is the smallest unit it's possible to index on a hard disk.
The partition table uses sectors to identify where a partition starts (it's offset from the start of the disk) and how large it is (how many sectors it contains/spans). Sectors are indexed using Logical Block Addressing (LBA).
sysprep - "The System Preparation (Sysprep) tool prepares an installation of Windows for duplication, auditing, and customer delivery. Duplication, also called imaging, enables you to capture a customized Windows image that you can reuse throughout an organization...." - https://technet.microsoft.com/. Used to create a Sysprepped Windows Operating System.
sysprepped - Windows Operating System prepared for disk cloning and restoration - see Sysprep
System Volume - the Volume or Partition that contains the Windows Operating System files. Please note that Microsoft refers to this as the "Boot Volume". On MBR Disks the same volume can be both the boot volume and system volume.
UEFI - Unified Extensible Firmware Interface. A firmware type used on computer systems containing code which is executed when the device is switched on or (re)booted - prior to any operating system being loaded.
Unpartitioned Hard Disk - a Hard Disk type device that does not contain any existing Partitions - the Partition Table is empty. In the scope of this guide an unpartitioned hard disk can refer to a disk that has been initialized, or a blank disk containing all 00's.
Volume Boot Record - or VBR. The start of a partition or device that contains machine mode that will continue the boot process. On Windows NT 6.* systems the code in the VBR will load bootmgr - the Windows Boot Manager. On partitioned storage devices (e.g. a hard disk drive) VBR refers to the first sector (or sectors depending on the File System) of the partition. On non-partitioned storage devices (e.g. a floppy disk) the VBR refers to the first sector of the device. The VBR is also referred to as the Boot Sector or Partition Boot Record (PBR).
