• File Systems• The file system dictates how information is organized on the

disk. For example, the file system determines how large the allocation unit, or storage unit, of a file is. If you create a 12K file, how much space is that file really using — 12K, 16K, or 32K? Such organizational issues are what the file system deals with.

• The FAT file system• The File Allocation Table (FAT) file system has been the most

popular file system up until the last few years. Although the FAT file system is the most common (it can be used by all operating systems), it is losing the popularity contest to its successor — FAT32 — due to its age and limitations.

• The FAT file system was • used by DOS, Windows 3.1, and Windows 95, and is

supported in Windows NT, Windows 98/Me, and Windows 2000/XP/2003. FAT’s biggest strength is that it’s the file system most widely understood by different operating systems.

• cannot create a partition larger than 2GB.• FAT’s major benefit — most operating systems can run on it, which

makes it a great file system for configuring a dual-boot system. • Reasons to dual boot• There are a number of reasons you may want to have a dual-boot

system: • Software doesn’t run smoothly on one operating system, so you install

an additional operating system and boot to that OS to run your software.

• You are part of the help desk team in an organization that runs two different operating systems, and you will need to boot to the appropriate OS to find solutions to problems

• The FAT32 file system• A benefit of FAT32 over FAT system was that the maximum partition

size was increased from 2GB to 2 terabytes (TB).• Although FAT32 has the capability to have partitions of 2 TB in size,

Microsoft has limited the size of FAT32 partitions in Windows 2000/XP operating systems to 32GB — their reasoning for this is that you should be using NTFS as a file system.

• The other major benefit to FAT32 is that it dramatically decreases the cluster size to make better use of disk space. Table 5-7 compares the default cluster sizes of FAT partitions with the default cluster sizes of FAT32 partitions. Note that FAT32 doesn’t support partitions smaller than 512MB.

• One of the shortfalls of FAT32 is that MS-DOS, Windows 3.1, the original release of Windows 95, and Windows NT 4.0 do not support it. This means that only Windows 95 OSR2, Windows 98, Windows ME, and Windows 2000/XP/2003 can access data on a FAT32 partition, which is great considering these are the popular operating systems today.

• NTFS• Starting with Windows NT, Microsoft implemented a new file system

called New Technology File System (NTFS). NTFS makes better use of the space available on a particular disk by using 512 bytes as the cluster size, which is the same size as a sector! This means that you are wasting even less space on an NTFS file system than on a FAT32 file system.

• The original version of NTFS supported a number of features that made it more attractive than the FAT versions of the file systems.

• You could configure permissions that controlled who could access what files.

• You could also take advantage of features such as compression and auditing.

• One of the biggest complaints with the original version of NTFS is that it had no way to limit how much disk space a user could use. As a result, users could waste gigabytes of hard disk space on the server, and the administrator could not stop the user unless a third-party program was purchased.

NTFS 5.0• This newer version of NTFS has a few extra features over original implementations

of NTFS, one of which has been long overdue — disk quotas. Disk quotas allow the system’s administrator to choose the amount of disk space that each user is allowed to use by placing a limit on the disk. For example, when managing the home directories, you can ensure that Bob is not allowed to use more than 500MB of disk space.

• Another feature of NTFS 5.0 is the Encrypting File System (EFS). EFS uses public key/private key technology to encrypt a file stored on the hard drive.

• When a file or folder is encrypted with EFS, only the person who created the file or the recovery agent (by default, the administrator is the recovery agent) can open the file. When using EFS, even if another user has permission to view the file, he or she will be unable to do so because the file is encrypted.

• To summarize, the NTFS file system offers the following features over FAT and FAT32:The capability to secure the resource through permissionsThe capability to secure files through encryptionThe capability to enable auditing to monitor who accesses the files and foldersThe ability to compress the contents of a file or folder

• Managing Partitions and Volumes• A partition is defined as a segment of the hard disk, created by dividing the disk

logically into discrete units. why ? To separate Data and Software, to load two operating system.

• You are limited to four partitions per disk, so be sure to plan them carefully.• Two types of partitions: primary partitions and extended partitions.Primary partition• This is the partition that the computer boots from; the operating system’s boot

files are loaded from here. You are allowed to have four primary partitions per disk. Because you may have multiple primary partitions, you must designate one primary partition as the active partition — the partition from which your normal operating system loads.

Extended partition• An extended partition allows you to extend beyond the four-partition barrier by

being a partition that contains one or more logical drives. A logical drive is a block of disk space that is assigned a drive letter. As an example on how you could use extended partitions, you could set up three primary partitions and then decide that you would like to divide the last chunk of free space into three additional parts (for a total of six partitions).

• As an example, suppose you’re partitioning a 6GB hard drive using the FAT file system. FAT cannot define partitions larger than 2GB, so you have to divide this drive into at least three different partitions: The first partition you define is the primary partition — a 2GB partition that also becomes the active partition (drive C). What’s left is a 4GB extended partition that can store two logical drives (D and E), each of which can be no larger than 2GB.

• Note that the extended partition itself has no drive letter assigned to it. The extended partition is just a container to hold the logical drives — and they take the drive letters. Users of the system will be able to store data on drive C, drive D, or drive E!

• Note that when you create the partition during the installation of Windows the partition is automatically marked as being the active partition.

• When managing a disk in Windows 2000/XP/Server 2003, be aware that there are two types of disks: basic and dynamic.

• Basic disks• Basic disk is the term Microsoft uses to describe a disk that

supports partitions and all the limitations of partitions. If you can create partitions on a disk in Disk Management, then you are working with a basic disk. A basic disk has the following characteristics:

• The disk is divided into partitions• You are limited to four partitions per disk• You are limited to one extended partition per disk• You create primary partitions, extended partitions, and

logical drives• A basic disk is the default disk type in Windows

2000/XP/2003

• Dynamic disks• A dynamic disk doesn’t use partitions but rather volumes as discrete units of space. Because

you are creating volumes instead of partitions, you don’t have the four-partition limitation of basic disks. With dynamic disks, you are allowed to create as many volumes as you wish.

Types of volume :• Simple volume: is just a block of space that is similar in concept to a partition.• Striped volume: is a volume that is made up of equal space across multiple hard disks. With

striped volumes, when a file is saved to the volume, the file is saved across both disks at the same time. The benefit of a striped volume is a performance benefit from the fact that multiple disks are working at the same time to save the file.

• Spanned volume: is a volume that is made up of unequal amounts of space that span multiple disks. The benefit of this is that multiple areas of free spaces can joined to create a single volume that users can access through a single drive letter.

• Mirrored volume: is a volume that is made up of two disks. Data that is written to the volume is stored on both disks, each with a full copy of the data. If one of the disks should fail, the other disk has a copy of the data. Mirrored volumes are only supported on the server versions of the Windows operating systems.

• RAID 5 Volume: A RAID 5 volume uses between 3 and 32 disks. Data saved to the volume is spread across all disks in the volume, along with parity data. The parity data is used to calculate data that is unreadable due to a failed disk in the volume.

• RAID 5 volumes are also available only on server versions of the Windows operating system, so you won’t be able to create one on Windows XP.

• Management Tools• After partitioning the disk and formatting the drive, some maintenance

still needs to be done on a regular basis. Drive maintenance helps you address two areas of concern that have an impact on a user’s data:

• File system optimization: This means getting the best performance from your file system. If you can open the files stored on a computer but they open much more slowly than they did two months ago, your system needs optimizing.

• Data integrity: This means having files that are uncorrupted so the data is intact and accessible. Sometimes a file cannot be opened because the file system has lost parts of the file or portions of the disk are bad — in which case you are not concerned with performance but instead concerned about being able to open the file.

• Some operating system tools that can help you accomplish these two goals are– Defragmentation utility– Check Disk utility– Disk Cleanup

Purpose of Operating Systems

• are responsible for managing hardware, resources, and data.

• consists of displaying an interface that always reacts the same way and makes it easy for users to perform the tasks that they want.

System RequirementsWindows XP

Windows Vista

Linux Mac OS

Processor 300 MHz 800 MHz 500 MHz

IBM and Motorola Systems

Memory 128MB 512MB 256MB

Hard Disk 1.5GB of available disk space

20GB with 15GB offree space

800MB

CPU Support Single or Dual CPU

Single or Dual CPU

Display Super VGA or better

DirectX 9.0 capable

800 x 600 display

The architecture

Ways of Installation• Bootable Floppy– fdisk– CD ROM Driver

• Bootable CD• Network Installation– i386 must be stored on the net server

• Drive Imaging– Ghost or DriveImage Pro.

• Booting from Flash– Win to Flash or Equivalents

Attended Installations of WindowsAttended installations are installations that you attend, or sit through, and answer all the questions that the setup program asks.The Windows attended installation is broken down into three major phases:

✦ Setup loader: is initiated by calling winnt.exe or winnt32.exe or by booting from the Windows 2000/XP CD-ROM. This phase copies setupldr, which is a mini-version of ntldr used by the setup program, and copies to the hard drive any files that the Windows setup utility needs.

✦ Text-mode phase: is typically identified by the text-based environment that has a blue background. It is responsible for detecting basic hardware components such as CPU, motherboard, and hard drives.

Cont’d …This phase also creates the Registry, partitions and formats the drives,

creates the file systems, and verifies that you have enough hard disk space to complete the installation. After the setup verifies that you have enough hard disk space, it copies files that are needed by the setup program to the hard disk.

✦ GUI-mode phase: After the text-mode portion of the install, the system restarts and moves into the GUI-mode phase. This phase of the setup can be quickly identified by the use of a wizard and it’s Windows-like shell. The wizard asks questions; you answer each question and click Next to go to the next question. This phase of the setup detects additional devices, installs drivers for those devices, and copies additional necessary setup files that weren’t copied during the text-mode phase. During this phase, you are asked for information, such as your name, your organization, and your product key for the Windows operating system, and you are asked to agree to the end-user licensing agreement (EULA).

Standard Boot Process for Windows XPntldr

• ntldr is the boot loader for Windows XP. • coordinate the loading of the rest of the OS. • is located on the root of your system partition, and if it

is corrupted, it can easily be replaced from any other working copy of Windows XP.

• switches the memory model to a flat memory model. • If the computer requires the ntbootdd.sys file, which is

a SCSI controller driver, then it is loaded by ntldr so the rest of the boot process can access the boot drive.

• Finally it reads the boot.ini file, if it exists, and displays the list of possible OSes that can be booted.

Cont’d

ntbootdd.sys• If you boot your computer from an IDE/ATA drive or a

SCSI drive from a SCSI controller that supports its own BIOS, you won’t see the ntbootdd.sys file on your computer.

• However, if you are loading Windows XP from a SCSI drive on a controller that does not have its own BIOS, ntbootdd.sys appears on the root of the drive that has ntldr on it. ntbootdd.sys is the SCSI driver for your SCSI controller, but it has been renamed from the driver’s actual name to ntbootdd.sys.

Cont’dboot.ini• The boot.ini file is a text file on the root of your system partition

that lists the OSes that are available to boot. • It contains

– the default timeout value for the boot menu– where ntldr can find each copy of the OS– The strings used in this file are the display text for the boot menu.

• If you have only one copy of Windows 2000 or Windows XP installed, then you won’t see the boot menu at all, since there is only one choice of operating system to load.

Cont’dntdetect.comThe next step after having chosen Windows XP from the boot.ini menu is to have ntdetect.com run. only job is to find out what hardware is present on the system. It is similar to what happens during the POST process at the hardware level. ntdetect.com checks for the following components:

✦ Bus/adapter type Communication ports✦ ✦ Computer ID Floating-point coprocessor✦ ✦ Floppy disks Keyboard✦ ✦ Mouse/pointing device Parallel ports✦ ✦ SCSI adapters Video adapters✦

This information creates a hardware tree that is passed back to ntldr and eventually given to ntoskrnl.exe, which places it in the Registry.

The device load process• All the devices that are to be loaded during the system startup

are listed in the Registry. The Registry includes information about each device in:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<device>

The service load process• All the services that are to be loaded during the system startup

are listed in the Registry. The Registry includes information about each device in the following location:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<service>

• This is the same location that’s used for devices. The biggest difference between devices and services is that devices map out to a physical piece of hardware, while services are only software.

Loading the shell• After the processing of all the device drivers, the user’s

shell loads. The application that makes up the shell is actually defined by a shell = line in system.ini, the default being explorer.exe.

• Explorer checks the Registry to see what desktop components are supposed to be displayed and then checks the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices key in the Registry to auto-start other applications. One of the services started at this point is the network service. When the network service is started up, you will be presented with a logon screen.

• Next Explorer then executes any entries that it finds in the Registry in the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce key. When these are completed, Explorer then moves on to the run and load entries in win.ini to launch additional applications, followed by the run entries in the Registry, found in HKEY_LOCAL_MACHINE\Software\ Microsoft\Windows\CurrentVersion\Run, and finally the Startup group from the Start menu.

• This process is almost identical for all versions of Windows that are based on Windows NT.

The basic file attributesAll files on your computer, regardless of your Microsoft operating system or file system, have these four basic attributes:

✦ Read-only:-Files with this attribute cannot be deleted from the command line and cannot be written to or saved over.

✦ Hidden:-These files are not visible to users unless those users have changed their viewing options to display hidden files.

✦ System:-System files are flagged as being required by the operating system. They cannot have their attributes changed by the attrib.exe command.

✦ Archive:-Files with the archive attribute are ready for archiving or backing up. This attribute is used by some backup programs so that they can perform incremental backups.

Cont’dntoskrnl.exe• The OS kernel for Windows XP is responsible for all thread level

scheduling on the system. It plays a major control role, managing all of the other components on the system. Without it, there would be anarchy in the OS. ntoskrnl.exe starts loading the OS into memory.

• ntldr proceeds to the path that is specified in boot.ini to locate ntoskrnl.exe in the system32 folder. If ntldr locates the kernel, it proceeds to execute it. ntldr will generate a missing kernel error message if it fails to locate the kernel. Once the kernel is running, ntldr passes control of the system over to it. There are several steps to the kernel load, starting with loading devices, and then moving on to loading any system services. Once the services are running, it loads the default shell application and user profile.

• The default user profile is used to run the user logon process. At this point, the logon screen will tell you to “Press Ctrl+Alt+Delete to begin.” After providing logon credentials, that user session is discarded, and a new one is started up for the new user.