Title: 6. Understanding Microsoft Startup Tasks
Course: IN 2005 Digital Forensics > Section: Module 6: Chapter 6 - Working with Windows and DOS Systems

Understanding Microsoft Startup Tasks

1. In this section, you will learn what files are accessed when Windows starts.  This information helps you determine when a suspect’s computer was last accessed, which is particularly important with computers that might have been used after an incident was reported.

Startup in Windows NT and Later

1. All NTFS computers perform the following steps when the computer is turned on:
  - Power-on self test (POST)
  - Initial startup
  - Boot loader
  - Hardware detection and configuration
  - Kernel loading
  - User logon
2. The startup Files for Windows XP, including:
  - NT Loader (NTLDR)
  - Boot.ini
  - BootSect.dos
  - NTDetect.com
  - NTBootdd.sys
  - Ntoskrnl.exe
  - Hal.dll
  - Pagefile.sys
  - Device drivers
3. See Table 6-8 to view the Windows XP system files.
4. When you start a Windows XP NTFS workstation, several files are accessed immediately.  The last access date and time stamp for the files change to the current date and time.  This change destroys any potential evidence that shows when a Windows XP workstation was last used.

Startup in Windows 9x/Me

1. System files in Windows 9x/Me containing valuable information can be altered easily during startup.
2. Windows 9x and Windows Me have similar boot processes.  With Windows Me, you can’t boot to a true MS-DOS mode.
3. The following two boot modes available within Windows 9x OSs:
  - DOS protected-mode interface (DPMI)
  - Protected-mode GUI
4. The system files Windows 9x uses have their origin in MS-DOS 6.22.  The IO.sys file communicates between a computer’s BIOS, the hardware and the OS kernel.  If F8 is pressed during startup, IO.sys loads the Windows Startup menu. See Figure 6-18.
5. Msdos.sys is a hidden text file containing startup options for Windows 9x.  The Command.com provides a command prompt when booting to MS-DOS mode (DPMI).