PC Help Guide

I had an email from one of our readers from NZ asking about NTLDR. Basically he said he heard the term at uni but had no idea what it was or meant, and could we help him. Well Andrew here is a basic overview of NTLDR and the NTLDR process;

NTLDR (abbreviation of NT Loader) is the boot loader for all releases of Microsoft’s Windows NT operating system up to and including Windows XP and Windows Server 2003. NTLDR is typically run from the primary hard disk drive, but it can also run from portable storage devices such as a CD-ROM, USB flash drive, or floppy disk. NTLDR can also load a non NT-based operating system given the appropriate boot sector in a file.

NTLDR requires, at the minimum, the following two files to be on the system volume: NTLDR, which contains the main boot loader itself, and boot.ini, which contains configuration options for a boot menu.

To load an NT-based OS, ntdetect.com must also be present. (Strictly speaking, only NTLDR is actually required. If boot.ini is missing, NTLDR will default to C:\Windows on the first partition of the first hard drive. Many desktops in the home are in this configuration and a missing boot.ini file will simply generate an error stating it is missing, then boot into Windows successfully.)

When booting, the loader proper portion of NTLDR does the following in order:

1. Accesses the file system on the boot drive (either FAT or NT File System NTFS).
2. If hiberfil.sys is found, and it finds a hibernation image, its contents are loaded into memory and the system resumes where it left off.
3. Otherwise, reads boot.ini and prompts the user with the boot menu accordingly.
4. If a non NT-based OS is selected, then NTLDR loads the associated file listed in boot.ini (bootsect.dos if no file is specified or if the user is booting into a DOS based OS) and gives it control.
5. If an NT-based OS is selected, then NTLDR runs ntdetect.com, which gathers information about the computer’s hardware.
6. Starts Ntoskrnl.exe, passing to it the information returned by ntdetect.com.