Major Operating System Files
Windows 9x
| AUTOEXEC.BAT | Plain text file. Batch file that executes command prompt instructions. Configures command prompt environment and loads TSRs. |
| COMMAND.COM | Command interpreter. Provides user interface to command prompt & processes keyboard commands. Contains other internal commands such as CD, COPY, VER, DIR. |
| CONFIG.SYS | Plain text file. Activates memory areas and loads real-mode device drivers using “DEVICE=” (Always use full path) |
| EMM386.exe | Simulates expanded memory for Windows. Requires HIMEM.SYS. |
| HIMEM.SYS | Extended memory manager (above 1 MB) that makes extended memory available to MS-DOS programs. Protects memory from being used by two programs at once. Use /TESTMEM:OFF to avoid memory test for faster boot. |
| IO.SYS | Hidden, System file. Must be first directory entry in the root in order to boot and first physical file on volume boot sector. Real-mode configuration manager. Contains information to start computer and read file system (FAT/FAT32). Reads MSDOS.SYS and load files and commands specified in CONFIG.SYS and AUTOEXEC.BAT. |
| MSDOS.SYS | Hidden, System file. Must be second directory entry in the root to in order to boot. Specifies startup options (e.g., splash screen to use) and identifies location of boot files and registry. Provides backward application compatibility for MS-DOS based apps. |
| SYSTEM.DAT (HKLM) | Operating system registry file. |
| SYSTEM.INI | Loads windows settings and drivers, provides MS-DOS application details. |
| USER.DAT (HKU) | User settings registry file. |
| VMM32.EXE | Virtual memory manager. Loads 3.xx device drivers having a DRV or 386 file extension (virtual mode drivers). These drivers will be located in the SYSTEM.INI file in the [ENH386] section. |
| WIN.COM | Starts Windows and takes control from IO.SYS |
| WIN.INI | Windows settings such as desktop, mouse, screen, keyboard, installed fonts, apps that run during startup. |
Windows 2000/XP
| BOOT.INI | Identifies disk information used for boot process. |
| NTBOOTDD.SYS | Contains SCSI boot drivers |
| NTDETECT.COM | Detects base system hardware. |
| NTLDR | Switches from real to protected mode. Starts minifile system drivers to read file system. Reads BOOT.INI and then loads the operating system. Also loads NTDETECT.COM and NTOSKRNL. |
| NTOSKRNL | Loaded by NTLDR to take control of system. Switches to graphical mode. |
| HKLM | Windows\System32\Config files: Software, System, SAM, security, Default, UserDiff) |
| NTUSER.DAT (HKU) | User settings registry file |