Spotmau Support Web Site » Uncategorized

PowerSuite2010 Quick Guide

admin — Wed, 20 Jan 2010 10:15:16 +0000

Four Steps to use Spotmau Powersuite 2010:

Step1: Download the.exe file(PowerSuite2010_Setup_Windows.exe)and install it.

Step2: Go to “PowerSuite BootCare 2010″ tab and download the BootCare.ISO file to create a Bootable CD.

Step3: Set your BIOS Boot Sequence to Boot firstly from CD (may be not necessary).

Step4: Boot From Spotmau CD.

After your purchase, you will receive a E-Mail with the download link. Just click the download link，save file to a path that you know.

After enough time passes, download will finish.

The file you download is an .exe file

Just double click this exe file to install our software.

please enter your info

Notice:

this license code is seven-letter combinations and each combination have five letters/numbers,only letters/numbers and hyphens are allowed in the license code,any space is not included.So Please do not add any space key in either the front or the end! Otherwise,they will be invalid.

Setup2: download the BootCare.ISO

Burning a Bootable CD:

It’s possible (but unlikely) that BurnCDCC may not be compatible with all CD/DVD drives. In that case, some other program may be used to burn the ISO file to a CD. It is important to mention that one does not merely copy the ISO file to a CD. Instead, the program uses the information contained within the ISO file to create the appropriate CD. As long as you make whatever program you are using aware of the fact that you are dealing with an ISO file, it should work properly.

(Note: Please pay more attention to the Step 3.)

Step 1: Double click on the burncdcc.exe to run the BurnCDCC software.

Step 2:

On the BurnCDCC software, please click the Browse button to find and select the .ISO file you have downloaded.
Check the “Finalize” and the “Read Verify” box.
Selecting lower speed such as 4X or 8X is recommended.
Click on Start button to start burning your CD.
Insert a blank CD into your CD writer.

Step 3: Sometimes BurnCDCC will push your blank CD out from your CD writer and display a message as “Please insert a blank disc into the drive”. If this is the case, just push your blank CD back into your CD writer and press the “OK” button.

Step 4: After BurnCDCC starts burning the CD, the “Start” button becomes disabled.

Step 5: After BurnCDCC finishes the burning, the “Start” button will become enabled again and your CD writer will pop your CD out. Your CD is ready to use now! Press “Close” button to exit the BurnCDCC.

After burning, you will get the following files:

Notice: After the burning process is completed successfully, several files will be created on your CD instead of a single .ISO file.

How To Use Spotmau PowerSuite CD

Spotmau PowerSuite CD includes TWO parts:

(1) WinCare™

WinCare™ can run while you are in Windows. Just put the Spotmau PowerSuite™ CD into your CD drive and wait for it to run automatically. If it does not automatically run, please go to “My Computer”, and then browse the contents of this CD, and click the autorun.exe.

(2) BootCare™

BootCare™ can run only after your computer boots from the Spotmau PowerSuite™ CD. Just put this CD into your CD drive and restart your computer. If your computer does not boot from this CD, please read the instructions below.

If your computer does not boot from this CD:

If your computer does not boot from this CD, you may need to set your CD-ROM drive as the first boot device.

To set your CD-ROM drive as the first boot device you need to go into the system setup (BIOS). To go into the system setup you need to restart the computer and hit a specific key on the keyboard as soon as the screen comes up. You can refer to the right top corner or the bottom of the screen for the specified key. Below is a list of common BIOS keys.

Delete
F1
F2
F3
F5
F10
Escape
Insert
Control + Escape
Alt + Escape
Control + Alt + Escape
Control + Alt + Enter

On most systems a message will come up telling you which key to hit to enter the system setup. Below is a picture of a system starting up with a Phoenix-Award BIOS. Notice the message at the bottom of the display. On this particular system setup you would hit the Delete key while this message is being displayed to enter the setup utility.

Once you have entered the System Setup you should come to a main menu. Below is a picture of the main menu for a version of Phoenix-Award BIOS. Yours may not look exactly the same, but the basic idea is the same for all System Setup utilities.

In this particular System Setup utility, the boot device settings are under the ‘Advanced BIOS Features’ category. Yours may be in a different category. If your System Setup does not have an ‘Advanced BIOS Features’ category, try looking through the different categories until you find the boot device order settings. Below is a picture of the ‘Advanced BIOS Features’ category.

If the first boot device on your system is set to something else (floppy drive for example), simply change it to the CD-ROM drive. In the picture above you can also see some basic instructions on how to change the settings. Once the CD-ROM drive is set as the first boot device, you need to save the changes and exit the System Setup utility. Usually you can just hit ESC on the keyboard to go back to the main menu and then select ‘Save and Exit Setup’.

There are literally hundreds of versions of System Setup utilities and this is just one example; however the basic idea is the same for all of them. If your system setup does not look the same you may have to use a little intuition to find and change the boot device order.

Booting From Spotmau PowerSuite CD

After you set your Bios, Put the CD in your CD-rom and restart your PC.

Then you will be able to see the following options.

Then Spotmau is booting.

and then you will get

Finally you will be able to see the main pannel of Spotmau Bootcare2010.

If you can not boot from Spotmau Cd, it is likely that your hardware is not compatible with the common PCs. You can try the Advanced Mode to adjust Spotmau Drivers.

How to get your old system ready for a Windows 7 upgrade

admin — Wed, 02 Dec 2009 08:24:49 +0000

While most computer techs and savvy users usually advise against performing an upgrade from one Windows version to another (what’s called an “in-place upgrade”). There’s always the chance that your new OS could inherit some problems from the old, after all, and it could potentially cause issues with your current programs or hardware.

Truth is, some users want to upgrade and Windows 7 handles the process pretty well. While it might not be an ideal situation, there are plenty of people who are going to take a stroll down the upgrade path. A little careful prep work will help make the experience a pain-free one.

Where’s the best place to start? Why, with the Windows 7 Upgrade advisor (download it), of course!

This free program from Microsoft will perform an inspection of your computer and let you know if anything might cause you problems. After running the Advisor, you’ll see a report screen like the one below:

As you can see, on Brad’s test system hard drive space was a major concern. The Windows 7 Upgrade requires at least 16GB of free disk space. Why so much? Because during the install it needs plenty of elbow room to back up, move, and copy files. 16 gigs is the minimum – more free space is better.

If you happen to be running low, grab a couple free programs to help you make room. Start off with a round of CCleaner (read about it) (download it) – it’s a great way to clean up useless temp files. I’ve seen it remove as much as 12 gigabytes of crud from a system, so CCleaner can definitely be a difference maker.

Still need more room after running CCleaner? Fire up DriveSpacio (read about it) (download it), a free program that will quickly show how much space the files and folders on your computer are taking up. It’s a good way to find folders and files that are eating up excess gigabytes.

In addition to making sure space requirements are met, the advisor checks to see that the hardware in your system is capable of running Windows 7. Want the short version? Your computer can run Windows 7. Ideally you should have at least 1GB of memory (more is better) and a new-ish processor (say a p4 or Athlon that runs at 2 or more gigahertz).

In the real world, people have gotten Windows 7 to run on all kinds of clunky old hardware, so you’re probably in good shape even if the advisor spots some weaknesses. Drivers may be a problem, however, so make sure you can at least find Windows Vista drivers for anything the advisor calls to your attention. They’ll probably work just fine with Windows 7, too.

The advisor will also let you know if any of your existing programs don’t play well with Windows 7. It’s very important to look this list over carefully. Is there a program listed that you absolutely can’t do without? If so, you might want to reconsider your upgrade.

Windows 7 does offer a feature called XP Mode which is able to run many old applications, but it does require a bit of skill to get set up correctly. There’s also a good chance that some of your programs working by simply changing compatibility settings. I’ll go over getting old programs to work a little later on, so stay tuned!

As far as getting your data ready for the process, Windows 7 includes a revised version of Vista’s Easy Transfer tool. It does a fantastic job of gathering up your data from Windows XP and Vista machines and zapping it into your Windows 7 install.

While this isn’t technically necessary if you’re doing an upgrade it’s never a bad idea to play it safe. Running Easy Transfer gives you a Windows 7-friendly backup of your data and settings in case something goes wrong.

How to Start the Windows XP Recovery Console

admin — Mon, 03 Nov 2008 06:56:29 +0000

Windows XP Recovery Console

Download Recovery Console

How to Start the Windows XP Recovery Console

Windows XP Recovery Console is a very useful tool that helps you to fix your computer when you cannot boot the computer or log into your user account. The Recovery Console can uninstall Windows Updates such as Hotfixes and Service Packs, check specific drives, change or list Service’s start up configurations, expand files, rebuild boot entries, simple management of partitions, repair the boot sector on the system partition and repair the master boot record of the boot partition.

In this blog post I will describe how to start the Windows XP Recovery Console from the bootable retail Windows XP Installation media.

NOTE

Booting from the Windows XP Installation media provided by OEMs may not provide the Windows XP Recovery Console.

Requirements

Administrator Password
Bootable Windows XP Installation media
Floppy Drive and Floppy Media with SATA drivers if SATA drivers are required

Starting the Windows XP Recovery Console

Ensure the BIOS is set to boot from the CD / DVD drive. Refer to the Manufacturer’s instructions.
Insert Windows XP Installation CD and start the computer.
Press ANY Key to boot from the Windows XP Installation CD when the following screen appears. Refer to Image below.
Press F6 and insert the floppy media if SATA drivers are required. Refer to Image below.
Press R to enter the Windows XP Recovery Control. Refer to Image below.
Select the Windows Installation for the Recovery Console to use when the following screen appears. Refer to Image below. Most users will typically see one installation, therefore, press 1 on your keyboard.
Enter the Administrator’s password. Refer to Image below. If you do not remember setting the password for the built-in Administrator password then try no password (blank) and press ENTER.
When completing your Recovery Console tasks then type EXIT to reboot the computer.

Available Commands

To see a list of available commands for the Recovery Console, type HELP at the Recovery Console prompt. If you need more help for an available command, type HELP CommandName at the Recovery Console prompt.

NTLDR is missing, A disk read error occurred &; System hangs after BIOS POST finishes

admin — Thu, 09 Oct 2008 13:25:18 +0000

NTLDR is missing, A disk read error occurred & System hangs after BIOS POST finishes

When your computerpower up, it examines the master partition table to determine what volume to use to boot up the operating system, and detected invalid information within it. This is caused by an incorrect or missing active partition

Solution

Use Windows XP Recovery Console by fixboot command

Change BIOS settings to first boot from CD\DVD-ROM drive and boot from Windows XP CD. Presing ‘R’ key, you would see screen as below,

Select the drive number of inatlled Windows XP

Enter administrator password

FIXBOOT C:

This command rewrites the boot sector of the volume that you specify. You should execute the command on both the system and boot volumes if they are different.

FIXBOOT fixboot drive name

Write the new Windows boot sector code on the system partition. In this syntax, drive name is the drive letter where the boot sector will be written. This command fixes damage in the Windows boot sector. This command overrides the default setting, which writes to the system boot partition.

COPY CDDrive:\I386\NTLDR C:\
COPY CDDrive:\I386|NTDETECT.COM C:\
BOOTCFG /rebuild

Windows File System Formats

admin — Thu, 09 Oct 2008 13:24:25 +0000

Windows File System Formats

Windows includes support for the following file system formats:

CDFS
UDF
FAT12, FAT16, and FAT32
NTFS

Each of these formats is best suited for certain environments, as you’ll see in the following sections.

CDFS

CDFS (\Windows\System32\Drivers\Cdfs.sys), or CD-ROM file system, is a read-only file system driver that supports a superset of the ISO-9660 format as well as a superset of the Joliet disk format. While the ISO-9660 format is relatively simple and has limitations such as ASCII uppercase names with a maximum length of 32 characters, Joliet is more flexible and supports UNICODE names of arbitrary length, for example. If structures for both formats are present on a disk (to offer maximum compatibility), CDFS uses the Joliet format. CDFS has a number of restrictions:

A maximum file size of 4 GB
A maximum of 65,535 directories

CDFS is considered a legacy format because the industry has adopted the Universal Disk Format (UDF) as the standard for read-only media.

UDF

The Windows UDF file system implementation is OSTA (Optical Storage Technology) UDFcompliant. (UDF is a subset of the ISO-13346 format with extensions for formats such as CD-R and DVD-R/RW.) OSTA defined UDF in 1995 as a format to replace the ISO-9660 format for magneto-optical storage media, mainly DVD-ROM. UDF is included in the DVD specification and is more flexible than CDFS. The UDF driver supports UDF versions 1.02, version 1.5 on Windows 2000, and versions 2.0 and 2.01 on Windows XP and Windows Server 2003. UDF file systems have the following traits:

Directory and filenames can be 254 ASCII or 127 UNICODE characters long.
Files can be sparse. (Sparse files are defined later in the chapter.)
File sizes are specified with 64-bits.

Although the UDF format was designed with rewritable media in mind, the Windows UDF driver (\Windows\System32\Drivers\Udfs.sys) provides read-only support. In addition, Windows does not implement support for other UDF features, including named streams, access control lists, or extended attributes.

FAT12, FAT16, and FAT32

Windows supports the FAT file system primarily to enable upgrades from other versions of Microsoft Windows, for compatibility with other operating systems in multiboot systems, and as a floppy disk format. The Windows FAT file system driver is implemented in \Windows\ System32\Drivers\Fastfat.sys.

The name of each FAT format includes a number that indicates the number of bits the format uses to identify clusters on a disk. FAT12’s 12-bit cluster identifier limits a partition to storing a maximum of 212 (4096) clusters. Windows uses cluster sizes from 512 bytes to 8 KB in size, which limits a FAT12 volume size to 32 MB. Therefore, Windows uses FAT12 as the format for all 5-inch floppy disks and 3.5-inch floppy disks, which store up to 1.44 MB of data.

Note

All FAT file system types reserve the first two clusters and the last 16 clusters of a volume, so the number of usable clusters for a FAT12 volume, for instance, is slightly less than 4096.

FAT16, with a 16-bit cluster identifier, can address 216 (65,536) clusters. On Windows, FAT16 cluster sizes range from 512 bytes (the sector size) to 64 KB, which limits FAT16 volume sizes to 4 GB. The cluster size Windows uses depends on the size of a volume. The various sizes are listed in . If you format a volume that is less than 16 MB as FAT by using the format command or the Disk Management snap-in, Windows uses the FAT12 format instead of FAT16.

Volume Size	Cluster Size	0–32 MB	512 bytes	33 MB–64 MB	1 KB	65 MB–128 MB	2 KB
129 MB–256 MB	4 KB
257 MB–511 MB	8 KB
512 MB–1023 MB	16 KB
1024 MB–2047 MB	32 KB
2048 MB–4095 MB	64 KB

A FAT volume is divided into several regions, which are shown in Figure 12-2. The file allocation table, which gives the FAT file system format its name, has one entry for each cluster on a volume. Because the file allocation table is critical to the successful interpretation of a volume’s contents, the FAT format maintains two copies of the table so that if a file system driver or consistency-checking program (such as Chkdsk) can’t access one (because of a bad disk sector, for example) it can read from the other.

Entries in the file allocation table define file-allocation chains (shown in Figure 12-3) for files and directories, where the links in the chain are indexes to the next cluster of a file’s data. A file’s directory entry stores the starting cluster of the file. The last entry of the file’s allocation chain is the reserved value of 0xFFFF for FAT16 and 0xFFF for FAT12. The FAT entries for unused clusters have a value of 0. You can see in Figure 12-3 that FILE1 is assigned clusters 2, 3, and 4; FILE2 is fragmented and uses clusters 5, 6, and 8; and FILE3 uses only cluster 7. Reading a file from a FAT volume can involve reading large portions of a file allocation table to traverse the file’s allocation chains.

Figure 12-3. Sample FAT file-allocation chains

The root directory of FAT12 and FAT16 volumes are preassigned enough space at the start of a volume to store 256 directory entries, which places an upper limit on the number of files and directories that can be stored in the root directory. (There’s no preassigned space or size limit on FAT32 root directories.) A FAT directory entry is 32 bytes and stores a file’s name, size, starting cluster, and time stamp (last-accessed, created, and so on) information. If a file has a name that is Unicode or that doesn’t follow the MS-DOS 8.3 naming convention, additional directory entries are allocated to store the long filename. The supplementary entries precede the file’s main entry. Figure 12-4 shows a sample directory entry for a file named “The quick brown fox.” The system has created a THEQUI1.FOX 8.3 representation of the name (that is, you don’t see a “.” in the directory entry because it is assumed to come after the eighth character) and used two more directory entries to store the Unicode long filename. Each row in the figure is made up of 16 bytes.

Figure 12-4. FAT directory entry

FAT32 is the most recently defined FAT-based file system format, and it’s included with Windows 95 OSR2, Windows 98, and Windows Millennium Edition. FAT32 uses 32-bit cluster identifiers but reserves the high 4 bits, so in effect it has 28-bit cluster identifiers. Because FAT32 cluster sizes can be as large as 32 KB, FAT32 has a theoretical ability to address 8-terabyte (TB) volumes. Although Windows works with existing FAT32 volumes of larger sizes (created in other operating systems), it limits new FAT32 volumes to a maximum of 32 GB. FAT32’s higher potential cluster numbers let it manage disks more efficiently than FAT16; it can handle up to 128-MB volumes with 512-byte clusters. Table 12-2 shows default cluster sizes for FAT32 volumes.

Partition Size	Cluster Size	32 MB–8 GB	4 KB	8 GB–16 GB	8 KB	16 GB–32 GB	16 KB
32 GB	32 KB

Besides the higher limit on cluster numbers, other advantages FAT32 has over FAT12 and FAT16 include the fact that the FAT32 root directory isn’t stored at a predefined location on the volume, the root directory doesn’t have an upper limit on its size, and FAT32 stores a second copy of the boot sector for reliability. A limitation FAT32 shares with FAT16 is that the maximum file size is 4 GB because directories store file sizes as 32-bit values.

Note

Windows XP introduces support for FAT32 on DVD-RAM devices.

NTFS

As we said at the beginning of the chapter, the NTFS file system is the native file system format of Windows. NTFS uses 64-bit cluster numbers. This capacity gives NTFS the ability to address volumes of up to 16 exabytes (16 billion GB); however, Windows limits the size of an NTFS volume to that addressable with 32-bit clusters, which is slightly less than 256 TB (using 64-KB clusters). shows the default cluster sizes for NTFS volumes. (You can override the default when you format an NTFS volume.) NTFS also supports 2³²-1 files per volume. The NTFS format allows for files that are 16 exabytes in size, but the implementation limits the maximum file size to 16 TB.

Volume Size	Default Cluster Size	512 MB or less	512 bytes	513 MB–1024 MB (1 GB)	1 KB	1025 MB–2048 MB (2 GB)	2 KB
Greater than 2048 MB	4 KB

NTFS includes a number of advanced features, such as file and directory security, disk quotas, file compression, directory-based symbolic links, and encryption. One of its most significant features is recoverability. If a system is halted unexpectedly, the metadata of a FAT volume can be left in an inconsistent state, leading to the corruption of large amounts of file and directory data. NTFS logs changes to metadata in a transactional manner so that file system structures can be repaired to a consistent state with no loss of file or directory structure information. (File data can be lost, however.)

We’ll describe NTFS data structures and advanced features in detail later in this chapter.

Troubleshooting Windows stop messages

admin — Thu, 09 Oct 2008 08:01:47 +0000

STOP Messages literally mean Windows has stopped! These appear only in the NT-based operating systems: Win NT, Win 2000, Win XP, and Vista. Most are hardware issues. STOP messages are identified by an 8-digit hexadecimal number, but also commonly written in a shorthand notation; e.g., a STOP 0×0000000A may also be written Stop 0xA. Four additional 8-digit hex numbers may appear in parentheses, usually unique to your computer and the particular situation.

0×00000006: INVALID_PROCESS_DETACH_ATTEMPT
0×00000007: INVALID_SOFTWARE_INTERRUPT
0×00000008: IRQL_NOT_DISPATCH_LEVEL
0×00000009: IRQL_NOT_GREATER_OR_EQUAL

Windows Terminology

admin — Thu, 09 Oct 2008 03:33:36 +0000

access-control list (ACL): The part of a security descriptor that enumerates who has what access to an object. The owner of an object can change the object’s ACL to allow or disallow others access to the object. An ACL is made up of an ACL header and zero or more access-control entry (ACE) structures. An ACL with zero ACEs is called a null ACL and indicates that no user has access to the object.

access token: A data structure that contains the security identification of a process or a thread, which includes its security ID (SID), the list of groups that the user is a member of, and the list of privileges that are enabled and disabled. Each process has a primary access token that it inherits by default from its creating process.

add-device routine: A routine implemented by drivers that supports Plug and Play. The Plug and Play manager sends a driver notification via this routine whenever a device for which the driver is responsible is detected. In this routine, a driver typically allocates a device object to represent the device.

Address Windowing Extensions (AWE): A mechanism in Windows that allows a 32-bit application to allocate up to 128 GB of physical memory and then map views, or windows, into its 2-GB virtual address space. Using AWE puts the burden of managing mappings of virtual-to-physical memory on the programmer but solves the immediate need of being able to directly access more physical memory than can be mapped at any one time in a 32-bit process address space.

affinity mask: A bitmask that specifies the processors on which the thread is allowed to run. The initial thread affinity mask is inherited from the process affinity mask.

aging: A process performed on a page that increments a count indicating that the page hasn’t been referenced since the last working set trim scan. On a single-processor system, the working set manager tries to remove pages that haven’t been accessed recently. It does this by first clearing the accessed bit in the hardware page table entry (PTE) and then later checking the bit to see whether the page has been accessed. If the bit remains clear, the page wasn’t accessed between scans and is aged. Later, the age of pages is used to locate candidate pages to remove from the working set.

alertable wait state: A thread state that the thread enters either by waiting on an object handle and specifying that its wait is alertable (with the Windows WaitForMultiple- ObjectsEx function) or by testing directly whether it has a pending APC (using SleepEx). In both cases, if a user-mode APC is pending, the kernel interrupts (alerts) the thread, transfers control to the APC routine, and resumes the thread’s execution when the APC routine completes. User-mode APCs are delivered to a thread only when it’s in an alertable wait state.

allocation granularity: The granularity with which virtual memory is allocated. Windows aligns each region of reserved process address space to begin on an integral boundary defined by the system allocation granularity value, which can be retrieved from the Windows GetSystemInfo function. Currently, this value is 64 KB. This size was chosen so that if support were added for future processors with large page sizes (for example, up to 64 KB), the risk of requiring changes to applications that made assumptions about allocation alignment would be reduced. (Windows kernel-mode code isn’t subject to the same restrictions; it can reserve memory on a single-page granularity.)

alternative hive: A hive that acts as a backup to the crucial SYSTEM hive. The alternate hive is stored in \Winnt\System32\Config as System.alt. Whenever a hive sync flushes dirty sectors to the SYSTEM hive, the hive sync also updates the System.alt hive. If the configuration manager detects that the SYSTEM hive is corrupt when the system boots, the configuration manager attempts to load the alternate hive. If that hive is usable, it then uses that alternate to update the original SYSTEM hive.

APC queue: A queue in which asynchronous procedure calls (APCs) waiting to execute reside. The APC queues (one for user mode and one for kernel mode) are thread-specific—each thread has its own APC queues (unlike the DPC queue, which is processor- wide).

asymmetric multiprocessing (ASMP): A system of processing on a multiprocessor system that typically selects one processor to execute operating system code while other processors run only user code.

asynchronous I/O: An I/O model that allows an application to issue an I/O request and then continue executing while the request is completed. This type of I/O can improve an application’s throughput because it allows the application to continue with other work while an I/O operation is in progress.

asynchronous procedure call (APC): A function that provides a way for user programs and system code to execute code in the context of a particular user thread (and hence a particular process address space). An APC can be either kernel mode or user mode. (Kernel-mode APCs don’t require “permission” from a target thread to run in that thread’s context, as user-mode APCs do.)

asynchronous read-ahead with history: A method in which the cache manager maintains a history of the last two read requests in the private cache map for the file handle being accessed.

atomic transaction: A technique for handling modifications to a database so that system failures don’t affect the correctness or integrity of the database. The basic tenet of atomic transactions is that some database operations, called transactions, are all-or-nothing propositions. The separate disk updates that make up the transaction must be executed atomically; that is, once the transaction begins to execute, all its disk updates must be completed. If a system failure interrupts the transaction, the part that has been completed must be undone, or rolled back. The roll- back operation returns the database to a previously known and consistent state, as if the transaction had never occurred. See also transaction.

attribute list: A special kind of file attribute in an NTFS file header that contains additional attributes. The attribute list is created if a particular file has too many attributes to fit in the master file table (MFT) record. The attribute list attribute contains the name and type code of each of the file’s attributes and the file reference of the MFT record where the attribute is located.

authentication packages: Dynamic-link libraries (DLLs) that run in the context of the LSASS process and that implement Windows authentication policy. An authentication DLL is responsible for checking whether a given username and password match, and if so, returning to LSASS information detailing the user’s security identity. Windows authentication packages include Kerberos and MSV1_0.

automatic working set trimming: A technique the memory manager uses when physical memory runs low to increase the amount of free memory available in the system.

bad-cluster file: A system file (filename $Bad-Clus) that records any bad spots on the disk volume.

balance set manager: A system thread that wakes up once per second to check and possibly initiate various scheduling and memory management–related events.

basic disk: A disk that relies on the MS-DOS- style partitioning scheme. See also dynamic disk.

bitmap file: A system file (filename $Bitmap) in which NTFS records the allocation state of the volume. The data attribute for the bitmap file contains a bitmap, each of whose bits represents a cluster on the volume, identifying whether the cluster is free or has been allocated to a file.

boot code: Instructions executed when a system is booted.

boot device drivers: Device drivers necessary to boot the system.

boot file: A system file (filename $Boot) that stores the Windows bootstrap code.

boot partition: The partition that contains core operating system files. The boot partition is identified by the system at startup. The code in a master boot record (MBR) scans the primary partition table until it locates a partition containing a flag that signals the partition is bootable. When the MBR finds at least one such flag, it reads the first sector from the flagged partition into memory and transfers control to code within the partition.

boot sector: The first sector of the partition marked as active and from which the MBR boots. The boot sector contains information identifying the partition’s file system format and structure.

boot volume: The volume that contains the Windows operating system and its support files. The boot volume can be, but does not have to be, the same as the system volume.

bus driver: Driver that services a bus controller, adapter, bridge, or any device that has child devices. Bus drivers are required drivers, and Microsoft generally provides them; each type of bus (such as PCI, PCMCIA, and USB) on a system has one bus driver.

cache manager: The component of the Windows executive that provides systemwide caching services for NTFS and other file system drivers, including network file system drivers (servers and redirectors).

careful write: A technique for constructing a file system’s I/O and caching support. See also write-through.

change journal: An internal file where an NTFS file system can record information that allows applications to efficiently monitor file and directory changes. A change journal is usually large enough to virtually guarantee that applications get a chance to process changes without missing any.

checked build: A special debug version of Windows that is available only as part of the MSDN Professional (or Universal) subscription. The checked build is created by compiling the Windows sources with the compile- time flag DEBUG defined.

checkpoint record: A record that helps NTFS determine what processing would be needed to recover a volume if a crash were to occur immediately. This record also includes redo and undo information.

class driver: A type of kernel-mode device driver that implements the I/O processing for a particular class of devices, such as disk, tape, or CD-ROM.

clock algorithm: A working set page replacement policy implemented on uniprocessor systems, similar to a least recently used policy (as implemented in most versions of UNIX).

clock interrupt handler: A system routine that updates the system time and then decrements a counter that tracks how long the current thread has run.

cluster factor: The cluster size on a volume, which is established when a user formats the volume with either the format command or the Disk Management Microsoft Management Console (MMC) snap-in.

cluster remapping: A process in which NTFS dynamically retrieves good data from a cluster with a bad sector, allocates a new cluster, and copies the data to the new cluster.

clustering: A method by which the memory manager resolves a page fault by reading into memory several pages near the page explicitly accessed.

clusters: Same-size allocation units into which a volume is divided. Each cluster must be uniquely numbered using 16 bits.

collided page fault: A fault that occurs when another thread or process faults a page that is currently being in-paged.

commitment: The process by which the memory manager keeps track of private committed memory usage on a global basis.

common model: A set of classes in the Common Information Model (CIM) that represent objects that are specific to management areas of a system but independent of a particular implementation. These classes are considered an extension of the CIM core model. See also core model.

complete memory dump: A memory dump that contains all of physical memory at the time of the crash. This type of dump requires that a page file be at least the size of physical memory. Because it can require an inordinately large page file on large memory systems, this type of dump file is the least common. Windows NT 4 supported only this type of crash dump file.

completion port: A mechanism to deliver I/O completion notification to threads. Once a file is associated with a completion port, any asynchronous I/O operations that complete on the file result in a completion packet being queued to the completion port. A thread can wait for any outstanding I/Os to complete on multiple files simply by waiting for a completion packet to be queued to the completion port. With completion ports, concurrency, or the number of threads that an application has actively servicing client requests, is controlled with the aid of the system.

configuration manager: A major component of the executive that’s responsible for implementing and managing the system registry.

container object: A namespace object that can hold other objects, including other container objects. Examples of containers are directories in the file system namespace and keys in the registry namespace.

context switch: The procedure of saving the volatile machine state associated with a running thread, loading another thread’s volatile state, and starting the new thread’s execution.

control objects: A set of kernel objects that establishes semantics for controlling various operating system functions. This set includes the kernel process object, the asynchronous procedure call (APC) object, the deferred procedure call (DPC) object, and several objects the I/O system uses, such as the interrupt object.

core model: A set of classes in the Common Information Model (CIM) provided as part of the WBEM standard. These classes are CIM’s basic language and represent objects that apply to all areas of management. See also common model.

crash dump: A record of system memory at the time of a crash that can help you figure out which component caused the crash.

critical sections: An intra-process mutual exclusion synchronization primitive.

deadlock detection: A Driver Verifier option in Windows XP and Windows Server 2003 that monitors the use of spin locks, fast mutexes, and mutexes, looking for patterns that could result in deadlock.

deferred procedure call (DPC): A routine that performs most of the work involved in handling a device interrupt after the interrupt service routine (ISR) executes. The DPC routine executes at an interrupt request level (IRQL) that is lower than that of the ISR to avoid blocking other interrupts unnecessarily. A DPC routine initiates I/O completion and starts the next queued I/O operation on a device.

deferred procedure call (DPC) object: A kernel control object that describes a request to defer interrupt processing to DPC/dispatch level. (See interrupt request levels [irqls].) This object isn’t visible to user-mode programs but is visible to device drivers and other system code. The most important piece of information the DPC object contains is the address of the system function that the kernel will call when it processes the DPC interrupt.

Deferred ready: A state used for threads that have been selected to run on a specific processor but have not yet been scheduled. This new state in Windows Server 2003 exists so that the kernel can minimize the amount of time the systemwide lock on the scheduling database is held.

demand-paging policies: A fetch policy that loads a page into physical memory only when a page fault occurs. In a demand-paging system, a process incurs many page faults when its threads first begin executing because the threads reference the initial set of pages they need to get going. Once this set of pages is loaded into memory, the paging activity of the process decreases.

desired access rights: The accesses desired by a thread opening an object.

device drivers: Loadable kernel-mode modules (typically ending in .sys) that interface between the I/O system and the relevant hardware. Device drivers on Windows don’t manipulate hardware devices directly, but rather they call parts of the hardware application layer (HAL) to interface withthe hardware.

device ID: A device identifier reported to the Plug and Play manager. The identifiers are bus-specific; for a USB bus, an identifier consists of a vendor ID (VID) for the hardware vendor that made the device and a product ID (PID) that the vendor assigned to the device.

device instance ID (DIID): An identifier consisting of a device ID and an instance ID that the Plug and Play manager uses to locate the device’s key in the enumeration branch of the registry (HKLM\SYSTEM\CurrentControlSet\Enum).

device object: A data structure that represents a physical, logical, or virtual device on the system and describes its characteristics, such as the alignment it requires for buffers and the location of its device queue to hold incoming I/O request packets.

device-specific module (DSM): Third-party drivers used to manage details of the path management, such as load balancing policies that choose which path to route requests and error detection mechanisms to inform Windows when a path fails.

device tree: An internal tree the Plug and Play manager creates that represents the relationships between devices. Nodes in the tree are called devnodes. See also devnode.

devnode: A node in a device tree. A devnode contains information about the device objects that represent the device as well as other Plug and Play–related information the Plug and Play manager stores. See also device tree.

direct memory access (DMA): A third interface provided by the cache manager to cached data. The DMA functions are used to read from or write to cache pages without intervening buffers, such as when a network file system is doing a transfer over the network.

dirty page threshold: The number of pages that the system cache keeps in memory before waking up the cache manager’s lazy writer system thread to write out pages back to the disk. This value is computed at system initialization time and depends on physical memory size and the value of the registry value HKLM\SYSTEM\CurrentControlSet\ Control\Session Manager\Memory Management\LargeSystemCache.

discretionary access control: Allows the owner of a resource to determine who can access the resource and what they can do with it. The owner grants rights that permit various kinds of access to a user or to a group.

disk group: Dynamic disks that share a common database. VERITAS’s commercial volume-management software for Windows includes disk groups, but the Windows Logical Disk Manager (LDM) implementation includes only one disk group.

dispatch code: Instructions of assembly language code stored in an interrupt object when it is initialized. When an interrupt occurs, this code is executed.

dispatch routines: The main functions that a device driver provides. Some examples of dispatch routines are open, close, read, and write, and any other capabilities the device, file system, or network supports. When called on to perform an I/O operation, the I/O manager generates an IRP and calls a driver through one of the driver’s dispatch routines.

dispatcher: A set of routines in the kernel that implement Windows scheduling. Windows doesn’t have a single “scheduler” module or routine—the code is spread throughout the kernel in which scheduling-related events occur.

dispatcher database: A set of data structures the kernel maintains to make thread-scheduling decisions. The dispatcher database keeps track of which threads are waiting to execute and which processors are executing which threads. See also dispatcher ready queue.

dispatcher header: A data structure that contains the object type, the signaled state, and a list of the threads waiting on that object.

dispatcher objects: A set of kernel objects that incorporate synchronization capabilities and alter or affect thread scheduling. The dispatcher objects include the kernel thread, mutex (called mutant internally), event, kernel event pair, semaphore, timer, and waitable timer.

dispatcher ready queue: The most important structure in the dispatcher database (located at KiDispatcherReadyListHead). The dispatcher ready queue is really a series of queues, one queue for each scheduling priority. The queues contain threads that are in the ready state, waiting to be scheduled for execution.

display driver: Driver that translates device-independent graphics requests into device- specific requests. The device-specific requests are then paired with a kernel-mode video miniport driver to complete video display support. A display driver is responsible for implementing drawing operations, either by writing directly to the frame buffer or by communicating with the graphics accelerator chip on the controller.

driver object: Data structure that represents an individual driver in the system and records for the I/O manager the address of each of the driver’s dispatch routines (entry points).

driver support routines: Routines that device drivers call to accomplish their I/O requests.

dynamic disk: A disk that supports multipartition volumes, providing a more flexible partitioning scheme than that of a basic disk. See also basic disk.

dynamic-link library (DLL): A set of callable subroutines linked as a binary image that can be dynamically loaded by applications that use them.

environment subsystems: User processes and DLLs that expose the native operating system services to user applications, thus providing an operating system environment, or personality. Windows 2000 ships with two environment subsystems: Windows and POSIX (Windows NT 4.0 had one for OS/2 1.2). Windows XP and later only ship with Windows, but an enhanced POSIX subsystem is included with the free Services for Unix product from Microsoft.

event: An object with a persistent state (signaled or not signaled) that can be used for synchronization; also, a system occurrence that triggers an action.

exception: A synchronous condition that results from the execution of a particular instruction. Running a single program with the same data under the same conditions can reproduce exceptions.

exception dispatcher: A kernel module that services all exceptions, except those simple enough to be resolved by the trap handler. The exception dispatcher’s job is to find an exception handler that can “dispose of” the exception.

executive: The upper layer of Ntoskrnl.exe. (The kernel is the lower layer.) The executive contains the base operating system services, such as the process and thread manager, the virtual memory manager, the memory manager, the security reference monitor, the I/O system, and the cache manager. See also kernel.

executive objects: Objects implemented by various components of the executive (such as the process manager, memory manager, I/O subsystem, and so on). The executive objects and object services are primitives that the environment subsystems use to construct their own versions of objects and other resources. Because executive objects are typically created either by an environment subsystem on behalf of a user application or by various components of the operating system as part of their normal operation, many of them contain (encapsulate) one or more kernel objects. See also kernel objects.

executive resources: Resources that provide both exclusive access (such as a mutex) as well as shared read access (multiple readers sharing read-only access to a structure). Because executive resources are available only to kernel-mode code, they aren’t accessible from the Windows API.

executive support routines: Functions in Ntoskrnl.exe that provide services to device drivers.

extended partition: A special partition type that contains a master boot record (MBR) with its own partition table. By using extended partitions, Microsoft’s operating systems overcome the apparent limit of four partitions per disk. In general, the recursion that extended partitions permit can continue indefinitely, which means that no upper limit exists to the number of possible partitions on a disk. See also partition.

fast I/O: A means of reading or writing a cached file without going through the work of generating an I/O request packet (IRP).

fast LPC: A special interprocess communication facility used to send messages between threads.

file mapping objects: Windows APO underlying primitives in the memory manager that are used to implement shared memory (called section objects internally). See also section object.

file reference: A 64-bit value that identifies a file on an NTFS volume. The file reference consists of a file number and a sequence number. The file number corresponds to the position of the file’s file record in the master file table minus 1 (or to the position of the base file record minus 1 if the file has more than one file record).

file system driver (FSD): A type of kernel-mode device driver that accepts I/O requests to files and satisfies the requests by issuing its own, more explicit, requests to physical device drivers. See also local file system driver (FSD), network file system driver (FSD).

file system filter driver: A type of kernel-mode device driver that intercepts I/O requests, performs additional processing, and passes them on to lower-level drivers.

file system format: Defines the way that file data is stored on storage media and impacts a file system’s features. For example, a format that doesn’t allow user permissions to be associated with files and directories can’t support security. A file system format can also impose limits on the sizes of files and storage devices that the file system supports.

filter device object (FiDO): A device object that can be part of a devnode. One or more optional FiDOs can layer either between the physical device object (PDO) and the functional device object (FDO) or above the FDO. See also devnode, functional device object (FDO), physical device object (PDO).

filter driver: See file system filter driver.

frame-based exception handlers: The mechanism that permits each stack frame in a call stack to have its own exception handler declared.

foreground application: The process that owns the thread that owns the window that’s in focus.

free build: The version of the Windows system that can be purchased as a retail product. It is built with full compiler optimizations turned on and has internal symbol table information stripped out from the images. See also checked build.

function driver: The main device driver that provides the operational interface for its device. It is a required driver unless the device is used raw (an implementation in which I/O is done by the bus driver and any bus filter drivers, such as SCSI PassThru). A function driver is the driver that knows the most about a particular device and is usually the only driver that accesses device-specific registers.

functional device object (FDO): A device object that is a required part of a devnode. The function driver that the Plug and Play manager loads to manage a detected device creates the FDO. An FDO represents the logical interface to a device. See also devnode, filter device object (FiDO), physical device object (PDO).

granted access rights: The accesses granted to a thread by the security reference monitor as the result of a successful object open.

Graphical Identification and Authentication (GINA): A user-mode DLL that runs in the Winlogon process and that Winlogon uses to obtain a user’s name and password or smart card PIN. The standard GINA is \Winnt\System32\Msgina.dll.

handle: An object identifier. A process receives a handle to an object when it creates or opens an object by name. Referring to an object by its handle is faster than using its name because the object manager can skip the name lookup and find the object directly.

handle table: A table that contains pointers to all the objects that the process has opened a handle to. Handle tables are implemented as a three-level scheme, similar to the way that the x86 memory management unit implements virtual-to-physical address translation.

hardware abstraction layer (HAL): A loadable kernel-mode module (Hal.dll) that provides the low-level interface to the hardware platform on which Windows is running. The HAL hides hardware-dependent details such as I/O interfaces, interrupt controllers, and multiprocessor communication mechanisms—any functions that are architecture- specific and machine-dependent.

hardware device drivers: Device drivers that manipulate hardware to write output to or retrieve input from a physical device or network. There are many types of hardware device drivers, such as bus drivers, human interface drivers, mass storage drivers, and so on.

hash: A statistically unique value that is generated from a block of data (for example, a file) using cryptographic algorithms. Because different data results in different hashes, hashes can be used to detect changes to data from corruption or tampering. The Windows driver signing facility uses hashes.

heap: A region of one or more pages that can be subdivided and allocated in smaller chunks by a set of functions provided by the heap manager.

heap manager: A set of functions that allocate and deallocate variable amounts of memory (not on a page-size granularity). The heap manager functions exist in two places: Ntdll.dll and Ntoskrnl.exe. The subsystem APIs (such as the Windows heap APIs) use the copy in Ntdll, and various executive components and device drivers use the copy in Ntoskrnl.

hive: One of a number of files stored on disk that contain registry information. Each hive contains a registry tree, which has a key that serves as the root or starting point of the tree.

hyperspace: A special region used to map the process working set list and to temporarily map other physical pages for such operations as zeroing a page on the free list (when the zero list is empty and a zero page is needed), invalidating page table entries in other page tables (such as when a page is removed from the standby list), and on process creation setting up a new process’s address space.

I/O completion routine: A routine implemented by a layered driver that will notify the driver when a lower-level driver finishes processing an I/O request packet (IRP). For example, the I/O manager calls a file system driver’s I/O completion routine after a device driver finishes transferring data to or from a file. The completion routine notifies the file system driver about the operation’s success, failure, or cancellation, and it allows the file system driver to perform cleanup operations.

I/O request packet (IRP): A data structure that controls how the I/O operation is processed at each stage. Most I/O requests are represented by an IRP, which travels from one I/O system component to another.

I/O subsystem API: The internal executive system services (such as NtReadFile and NtWriteFile) that subsystem DLLs call to implement a subsystem’s documented I/O functions.

I/O system: The Windows executive component that accepts I/O requests (from both user-mode and kernel-mode callers) and delivers them, in a different form, to I/O devices.

ideal processor: The preferred processor that a particular thread should run on.

idle summary: A bitmask (KiIdleSummary) in which each set bit represents an idle processor.

impersonation: A capability that allows threads to have a different access token than that of the process.

initialization routine: A driver routine that the I/O manager executes when it loads the driver into the operating system. The initialization routine creates system objects that the I/O manager uses to recognize and access the driver.

in-paging I/O: A condition that occurs when a read operation must be issued to a file (paging or mapped) to satisfy a page fault. The inpage I/O operation is synchronous—the thread waits on an event until the I/O completes—and isn’t interruptible by asynchronous procedure call (APC) delivery.

instancing: The term for making separate copies of the same parts of a namespace. Instancing \DosDevices makes it possible for each user to have different drive letters and Windows objects such as serial ports.

intelligent file read-ahead: A technique that predicts what data the calling thread is likely to read next based on the data it’s currently reading.

inter-processor interrupt (IPI): An interrupt the kernel issues to request that another processor perform an action, such as dispatching a particular thread for execution or updating its translation look-aside buffer cache.

interrupt: An asynchronous event (one that can occur at any time) that is unrelated to what the processor is executing. Interrupts are generated primarily by I/O devices, processor clocks, or timers, and they can be enabled or disabled.

interrupt dispatch table (IDT): A data structure that Windows uses to locate the routine that will handle a particular interrupt. The interrupt request level (IRQL) of the interrupting source serves as a table index, and table entries point to the interrupt-handling routines.

interrupt dispatcher: A submodule of the kernel’s trap handler that responds to interrupts.

interrupt object: A kernel control object that allows device drivers to register interrupt service routines (ISRs) for their devices. An interrupt object contains all the information the kernel needs to associate a device ISR with a particular level of interrupt, including the address of the ISR, the interrupt request level (IRQL) at which the device interrupts, and the entry in the kernel’s interrupt dispatch table with which the ISR should be associated.

interrupt request (IRQ): A value identifying an interrupt. On x86 systems, external I/O interrupts come into one of the lines on an interrupt controller. The controller in turn interrupts the processor on a single line. Once the processor is interrupted, it queries the controller to get the interrupt request (IRQ). The interrupt controller translates the IRQ to an interrupt number, uses this number as an index into the interrupt dispatch table (IDT), and transfers control to the appropriate interrupt dispatch routine. At system boot time, Windows fills in the IDT with pointers to the kernel routines that handle each interrupt and exception.

interrupt request levels (IRQLs): An interrupt priority scheme imposed by Windows. The kernel represents IRQLs internally as a number from 0 through 31 (0 to 15 on 64-bit Windows), with higher numbers representing higher-priority interrupts. Although the kernel defines the standard set of IRQLs for software interrupts, the HAL maps hardware-interrupt numbers to the IRQLs.

interrupt service routine (ISR): A device driver routine that the kernel’s interrupt dispatcher transfers control to when a device issues an interrupt. In the Windows I/O model, ISRs run at a high device interrupt request level (IRQL), so they perform as little work as possible to avoid blocking lower-level interrupts unnecessarily. An ISR queues a deferred procedure call (DPC), which runs at a lower IRQL, to execute the remainder of interrupt processing. Only drivers for interrupt-driven devices have ISRs; a file system, for example, doesn’t have one.

job object: A nameable, securable, shareable object in Windows that controls certain attributes of processes associated with the job. A job object’s basic function is to allow groups of processes to be managed and manipulated as a unit. The job object also records basic accounting information for all processes associated with the job and for all processes that were associated with the job but have since terminated.

journaling: A logging technique originally developed for transaction processing that a recoverable file system such as NTFS uses to ensure volume consistency.

kernel: The lowest layer in Ntoskrnl.exe. The kernel, a component of the executive, determines how the operating system uses the processor or processors and ensures that they are used prudently. The kernel provides thread scheduling and dispatching, trap handling and exception dispatching, interrupt handling and dispatching, and multiprocessor synchronization. See also executive.

kernel debugger: A tool used to debug drivers, troubleshoot hung systems, and examine crash dumps. It is also a useful tool for investigating Windows internals because it can display internal Windows system information not visible through any standard utility. (The LiveKd tool on the companion CD allows the use of the standard kernel debuggers on a live system.)

kernel handle table: A table (referenced internally with the name ObpKernelHandle- Table) whose handles are accessible only from kernel mode and in any process context. A kernel-mode function can reference the handles in this table in any process context with no performance impact.

kernel memory dump: A type of memory dump (the default on Windows Server systems) that contains only the kernel-mode read/write pages present in physical memory at the time of the crash. A kernel memory dump doesn’t contain pages belonging to user processes. Because only kernel-mode code can directly cause Windows to crash, however, it’s unlikely that user process pages are necessary to debug a crash. There is no way to predict the size of a kernel memory dump because its size depends on the amount of kernel-mode memory allocated by the operating system and drivers present on the machine.

kernel mode: A privileged mode of code execution in a processor in which all memory is totally accessible and all CPU instructions can be issued. Operating system code (such as system services and device drivers) runs in kernel mode. See also user mode.

kernel objects: A primitive set of objects implemented by the Windows kernel. These objects aren’t visible to user-mode code but are created and used only within the executive. Kernel objects provide fundamental capabilities, such as synchronization, on which executive objects are built. See also executive objects.

kernel streaming filter drivers: Kernel-mode drivers chained together to perform signal processing on data streams, such as recording or displaying audio and video.

kernel-mode device driver: The only type of driver that can directly control and access hardware devices.

kernel-mode graphics driver: A Windows subsystem display or print device driver that translates device-independent graphics (GDI) requests into device-specific requests.

key: A mechanism to refer to data in the registry. Although keys appear in the object manager namespace, the registry manages them in a way similar to how it manages file objects. Zero or more key values are associated with a key object; key values contain data about the key.

key control block: A structure that stores the full pathname of a registry key, includes the cell index of the key node that the control block refers to, and contains a flag that notes whether the configuration manager needs to delete the key cell that the key control block refers to when the last handle for the key closes. In Windows, all key control blocks are in an alphabetized binary tree to enable quick searches for existing key control blocks by name. A key object points to its corresponding key control block, so if two applications open the same registry key, each will receive a key object and both key objects will point to a common key control block.

key object: An object type the configuration manager defines to integrate the registry’s namespace with the kernel’s general namespace.

keyed event: A synchronization object new to Windows XP.

last known good control set: A copy of the critical boot-time information under the registry key HKLM\SYSTEM\CurrentControlSet, made when a user successfully logs on. The last known good control set can be selected at boot time in case configuration changes made to the registry result in the system not being able to boot successfully.

local procedure call (LPC): An interprocess communication facility for high-speed message passing (not available through the Windows API but rather through an internal mechanism available only to Windows operating system components). LPCs are typically used between a server process and one or more client processes of that server. An LPC connection can be established between two user-mode processes or between a kernelmode component and a user-mode process.

local security authority (LSA) server: A usermode process running the image \Winnt\ System32\LSASS.exe that is responsible for the local system security policy (such as which users are allowed to log on to the machine, password policies, privileges granted to users and groups, and the system security auditing settings), user authentication, and sending security audit messages to the Event Log. The LSA service (Lsasrv – \Winnt\System32\ Lsasrv.dll), a library that LSASS loads, implements most of this functionality.

local security authority (LSA) server policy database: A database (stored in the registry under HKLM\SECURITY) that contains the system security policy settings. This data- base includes such information as what domains are trusted to authenticate logon attempts, who has permission to access the system and how (interactive, network, and service logons), who is assigned which privileges, and what kind of security auditing is to be performed.

Local Security Authority Subsystem (LSASS): The system user-mode process responsible for authentication of accounts accessing a computer.

Local System account: A predefined local account that is used to start a service and provide the security context for that service. The name of the account is NT AUTHORITY\System. This account does not have a password, and any password information that you supply is ignored. The Local System account has full access to the system, including the directory service on domain controllers. Because the Local System account acts as a computer on the network, it has access to network resources.

log file: A metadata file (filename $LogFile) NTFS uses to record all operations that affect the NTFS volume structure, including file creation or any commands, such as Copy, that alter the directory structure. The log file is used to recover an NTFS volume after a system failure.

log hive: A registry hive the configuration manager uses to make sure that a nonvolatile registry hive (one with an on-disk file) is always in a recoverable state. Each nonvolatile hive has an associated log hive, which is a hidden file with the same base name as the hive and a .log extension. See also hive.

logging: A transaction-processing technique NTFS uses to maintain file system integrity in case of system crashes or other failures. In NTFS logging, the suboperations of any transaction that alters important file system data structures are recorded in a log file before they are carried through on the disk so that if the system crashes, partially completed transactions can be redone or undone when the system comes back on line.

logical cluster numbers (LCNs): The numbers of all clusters from the beginning of the volume to the end with which NTFS refers to physical locations on a disk. To convert an LCN to a physical disk address, NTFS multiplies the LCN by the cluster factor to get the physical byte offset on the volume, as the disk driver interface requires.

logical prefetcher: The kernel component that monitors boot and application startup file access and that preemptively reads that data to speed up subsequent booting and application startups.

logical sequence numbers (LSNs): The numbers that NTFS uses to identify records written to the log file.

logon process: A user-mode process running Winlogon.exe that is responsible for capturing the username and password, sending them to the local security authority server for verification, and creating the initial process in the user’s session.

look-aside list: A fast memory allocation mechanism that contains only fixed-sized blocks. Look-aside lists can be either pageable or nonpageable, so they are allocated from paged or nonpaged pool.

LPC facility: Local procedure call interprocess communication support in the kernel.

mapped file I/O: The ability to view a file residing on disk as part of a process’s virtual memory. A program can access the file as a large array without buffering data or performing disk I/O. The program accesses memory, and the memory manager uses its paging mechanism to load the correct page from the disk file. If the application writes to its virtual address space, the memory manager writes the changes back to the file as part of normal paging.

mask: The process whereby interrupts wait for an executing thread to lower the IRQL before the interrupt is processed. Interrupts from a source with an IRQL above the current level interrupt the processor, whereas interrupts from sources with IRQLs equal to or below the current level are masked until an executing thread lowers the IRQL.

master file table (MFT): The heart of the NTFS volume structure. The MFT is implemented as an array of file records. The size of each file record is fixed at 1 KB, regardless of cluster size.

memory manager: The Windows executive component that implements demand-paged virtual memory, giving each process the illusion that it has a large virtual address space (while mapping a subset of that address space to physical memory).

metadata: Data that describes the files on a disk; also called volume structure data.

metadata files: A set of files in each NTFS volume that contains the information used to implement the file system structure.

MFT mirror: An NTFS metadata file (filename $MFTMirr) located in the middle of the disk called that contains a copy of the first few rows of the master file table.

miniport driver: A type of kernel-mode device driver that maps a generic I/O request to a type of port into an adapter type, such as a specific SCSI adapter.

mirrored volume: A volume on which the contents of a partition on one disk are duplicated in an equal-sized partition on another disk. Mirrored volumes are sometimes referred to as RAID level 1 (RAID-1).

mirror set: A technique by which the contents of a partition on one disk are duplicated in an equal-size partition on another disk.

modified page writer: A thread in the virtual memory manager that is responsible for limiting the size of the modified page list by writing pages to their backing store locations when the list becomes too big. The modified page writer consists of two system threads: one to write out modified pages (MiModifiedPageWriter) to the paging file and a second one to write modified pages to mapped files (MiMappedPageWriter).

mount: A technique NTFS uses when it first accesses a volume; in this context, to mount means to prepare the volume for use. To mount the volume, NTFS looks in the boot file to find the physical disk address of the master file table.

mount points: A mechanism that permits the linking of volumes through directories on NTFS volumes, which makes volumes accessible with no drive-letter assignment. Reparse points in NTFS make mount points possible.

MSDN: Microsoft Developer Network, Microsoft’s support program for developers. MSDN offers three CD-ROM subscription programs: MSDN Library, Professional, and Universal. For more information, see msdn.microsoft.com.

multipartition volumes: Objects that represent sectors from multiple partitions and that file system drivers manage as a single unit. Multipartition volumes offer performance, reliability, and sizing features that simple volumes don’t.

multipathing: Where more than one set of hardware exists between the computer and a disk so that if a path fails, the system can still access the disk via an alternate path.

mutant: Internal name for a mutex.

mutex: A synchronization mechanism used to serialize access to a resource.

mutual exclusion: A means whereby only one thread or processor is allowed access to a resource at any given time.

name retention: The first phase of object retention, which the object manager implements. Name retention is controlled by the number of open handles to an object that exist. Every time a process opens a handle to an object, the object manager increments the open handle counter in the object’s header. As processes finish using the object and close their handles to it, the object manager decrements the open handle counter. When the counter drops to 0, the object manager deletes the object’s name from its global namespace. This deletion prevents new processes from opening a handle to the object.

native application: An application that uses only system service APIs provided by Ntdll and that isn’t a client of the Windows subsystem. Smss (Session Manager) is an example of a native application.

network file system driver (FSD): A driver that allows users to access data volumes connected to remote computers. See also file system driver.

network logon service: A user-mode service inside the Services.exe process that responds to network logon requests. Authentication is handled as local logons are, by sending them to the LSASS process for verification.

network redirectors and servers: File system drivers that transmit remote I/O requests to a machine on the network and receive such requests, respectively.

nonpaged pool: Memory pool that consists of ranges of system virtual addresses that are guaranteed to be resident in physical memory at all times and thus can be accessed from any address space without incurring paging I/O. Nonpaged pool is created at system initialization and is used by kernel-mode components to allocate system memory.

Ntdll.dll: A special system-support library primarily for the use of subsystem DLLs that contains system service dispatch stubs to Windows executive system services and internal support functions used by subsystems, subsystem DLLs, and other native images.

Ntkrnlmp.exe: The executive and kernel for multiprocessor systems.

Ntoskrnl.exe: The executive and kernel for uniprocessor systems.

object: In the Windows executive, a single, run-time instance of a statically defined object type.

object attribute: A field of data in an object that partially defines the object’s state.

object directory: A container object for other objects. The object directory is used to implement the hierarchical namespace within which other object types are stored.

object handle: An index into a process-specific handle table, pointed to by the executive process (EPROCESS) block.

object manager: The Windows executive component responsible for creating, deleting, protecting, and tracking objects. The object manager centralizes resource control operations that would otherwise be scattered throughout the operating system.

object methods: The means for manipulating objects, usually to read or change the object attributes. For example, the open method for a process would accept a process identifier as input and return a pointer to the object as output.

object reuse protection: A means of preventing users from seeing data that another user has deleted or from accessing memory that another user previously used and then released. Object reuse protection prevents potential security holes by initializing all objects, including files and memory, before they are allocated to a user.

object type: A system-defined data type, including services that operate on instances of the data type and a set of object attributes; sometimes called an object class.

sector: A hardware-addressable portion of a physical disk. A hard disk sector on an IBM- compatible PC is typically 512 bytes. Utilities that prepare hard disks for the definition of logical drives, including the MS-DOS Fdisk utility or the Windows Setup program, write a sector of data called a master boot record (MBR) to the first sector on a hard disk. The MBR includes a fixed amount of space that contains executable instructions (called boot code) and a partition table with four entries that define the locations of the primary partitions on the disk. See also boot code, partition table.

secure attention sequence (SAS): A keystroke combination that when entered notifies Winlogon of a user logon request.

Secure logon facility: Requires that users can be uniquely identified and that they must be granted access to the computer only after they have been authenticated in some way.

Security Accounts Manager (SAM) service: A set of subroutines responsible for managing the database that contains the usernames and groups defined on the local machine or for a domain (if the system is a domain controller). The SAM runs in the context of the LSASS process.

security auditing: A way in which Windows detects and records important security-related events or any attempts to create, access, or delete system resources. Logon identifiers record the identities of all users, making it easier to trace anyone who performs an unauthorized action.

security descriptor: The data structure that specifies who can perform what actions on an object. A security descriptor consists of attributes.

security identifier (SID): A means of uniquely identifying entities that perform actions in a system. A SID is a variable-length numeric value that consists of a SID structure revision number, a 48-bit identifier authority value, and a variable number of 32-bit subauthority or relative identifier (RID) values.

security quality of service (SQOS): The indicator specified by a client opening a server resource that specifies the maximum level of client impersonation the server is allowed.

security reference monitor (SRM): A component in the Windows executive (Ntoskrnl.exe) that enforces security policies on the local computer. It guards operating system resources, performing run-time object protection and auditing.

semaphore: A counter that provides a resource gate by allowing some maximum number of threads to access the resources protected by the semaphore.

server processes: User processes that are Windows services, such as the Event Log and Schedule services. Many add-on server applications, such as Microsoft SQL Server and Microsoft Exchange Server, also include components that run as Windows services.

session: Consists of the processes and other system objects (such as the window station, desktops, and windows) that represent a single user’s workstation logon session. Each session has a session-specific paged pool area used by the kernel-mode portion of the Windows subsystem (Win32k.sys) to allocate session-private GUI data structures. In addition, each session has its own copy of the Windows subsystem process (Csrss.exe) and logon process (Winlogon.exe).

session space: A component of system space used to map information specific to a user session. The session working set list describes the parts of session space that are resident and in use.

shared cache map: A structure that describes the state of a cached file, including its size and (for security reasons) its valid data length.

volume set: A single logical volume composed of a maximum of 32 areas of free space on one or more disks.

Windows services: A mechanism to start processes at system startup time that provide services not tied to an interactive user. Services are similar to UNIX daemon processes and often implement the server side of client/server applications.

window station: A window station contains desktops, and desktops contain windows. Only one window station can be visible on a console and receive user mouse and keyboard input. In a Terminal Services environment, one window station per session is visible, but services all run as part of the console session.

Windows drivers: Device drivers that integrate with the Windows power manager and Plug and Play manager, when required. They include drivers for mass storage devices, protocol stacks, and network adapters.

Windows Management Instrumentation (WMI) manager: A component of the executive that enables device drivers to publish performance and configuration information and receive commands from the user-mode WMI service. Consumers of WMI information can be on the local machine or remote across the network.

work item: A unit of work placed on a queue dispatcher object when a device driver or an executive component requests a system worker thread’s services by calling the executive functions ExQueueWorkItem or Io- QueueWorkItem. Work items include a pointer to a routine and a parameter that the thread passes to the routine when it processes the work item. The routine is implemented by the device driver or executive component that requires passive-level execution.

working set: A subset of virtual pages resident in physical memory. There are two kinds of working sets—process working sets and the system working set.

working set manager: A routine that runs in the context of the balance set manager system thread to initiate automatic working set trimming to increase the amount of free memory available in the system. Although Windows attempts to keep memory available by writing modified pages to disk, when modified pages are being generated at a very high rate, more memory is required to meet memory demands. The working set manager is called when physical memory runs low (when MmAvailablePages is less than MmMinimumFreePages).

write-back: A caching strategy the lazy write file system uses to improve performance. In write-back, the file system writes file modifications to the cache and flushes the contents of the cache to disk in an optimized way, usually as a background activity.

write-through: An algorithm the FAT file system uses that causes disk modifications to be immediately written to the disk. Unlike the careful-write approach, the write-through technique doesn’t require the file system to order its writes to prevent inconsistencies. See also careful write.

write throttling: Prevents system performance from degrading because of a lack of memory when a file system or network server issues a large write operation.

zero page thread: A kernel-mode system thread (thread 0 in the system process). A zero page thread zeroes out pages on the free list so that a cache of zero pages is available to satisfy future demand-zero page faults.

Windows Boot Disks

admin — Tue, 09 Sep 2008 02:09:19 +0000

DOS 5.0 a b c

NTFS Bootdisks And Bootable CDs

Bootable Utility CD With 68 Programs For Both DOS And Windows. Setup Any Computer With Windows 98 or XP. Fix Just About Every Problem. Click HERE

Windows Boot Disks. 2000 And NT Setup Disk Sets

W2K Pro:
Disk1
Disk2
Disk3
Disk4

Non-Windows Based Image Files W/ImageApp

Rescue My Hard Disk

admin — Tue, 09 Sep 2008 01:50:49 +0000

Seagate

DiscWizard Starter Edition

This utility allows you to partition and format a new Hard Drive in preparation for installing an operating system. Download this to create a bootable floppy or CD.

DiscWizard Starter Edition

DiscWizard 2003

This utility has three functions. You can install a drive for additional storage, as the boot drive keeping the old drive in the system or as the boot drive removing the old drive from the system, all from within any Windows operating system.

DiscWizard 2003

DiscWizard Online

This is a web based version of DiscWizard 2003 and allows you to perform the same functions as above but online.

DiscWizard Online

SeaTools Online Edition

[quote]The SeaTools Online diagnostic engine uses “plug-ins” for your Internet Explorer or Netscape browser.

Data safe Drive Self Test (DST)
Checks SMART status
Tests most ATA and SCSI drives
Compatible with an Intel-based CPU
Creates a log of results
Examines file structure analysis[/quote]

SeaTools Online Edition

SeaTools Desktop Edition

[quote]This utility runs in Windows and creates a bootable diagnostic floppy diskette. You only run the program in Windows once.

Data safe tests
Tests most ATA and SCSI drives
Compatible with an Intel-based CPU
Creates a log of results
Prints Return Merchandise Authorization instructions and form
Error code explanations available on Seagate Web site
Creates self-booting diskette
Examines file structure analysis[/quote]

SeaTools Desktop Edition

Maxtor Corporation / Quantum HDD

May 22, 2006 – Seagate Technology completed acquisiton of Maxtor Corporation.
April 2, 2001 – Maxtor Corporation merged with Quantum Hard drive division (Quantum HDD).

Maxtor PowerMax v4.23The PowerMax utility is designed to perform diagnostic read/write verification on Maxtor and Quantum hard drives. These tests will determine hard drive integrity. The PowerMax utility is effective on ATA (IDE) hard drives with a capacity greater than or equal to 500 MB. Maxtor recommends the use of this utility for troubleshooting potential hard drive problems.

- Download PowerMax (English | TACKtech Mirror Direct Link | 1.03 MB)

Maxtor PowerMax 4.23 Bootable CD .ISO image file The POWERMAX utility is designed to perform diagnostic read/write verifications on Maxtor/Quantum hard drives. These tests will determine hard drive integrity. The POWERMAX utility is effective on all ATA (IDE) hard drives with a capacity greater than or equal to 500 MB. Maxtor recommends the use of this utility for troubleshooting potential hard drive problems.

- Download PowerMax (English | TACKtech Mirror Direct Link | 1.78 MB)

Maxtor/Quantum SCSIMax v1.21 (05.14.2003)
SCSIMax is a diagnostic utility for all Maxtor/Quantum® SCSI hard disk drives supporting Self-Monitoring, Analysis, and Reporting Technology (S.M.A.R.T).

Note: Incompatible with Apple® systems, and SCSI Ultra320 controllers. This utility does not run from the Windows desktop.

- Download SCSIMax (Direct Link | 70KB)
- View Additional Information

Maxtor Big Drive Enabler v1.0.3.1 (04.02.2003)
Maxtor’s Big Drive Enabler is a one step executable that enables support for drives larger than 137 Gigabytes in Windows 2000 Service Pack 3 and XP Service Pack 1. This utility takes the guess work out of editing the Windows registry. The Big Drive Enabler fixes an operating system limitation. This utility is needed anytime a Hard Disk Drive larger than 137 GB is connected to the motherboard’s ATA bus, regardless of any system BIOS that supports 48-bit LBA.

- Download Maxtor Big Drive Enabler (Direct Link | 64KB)
- View Additional Information

Fujitsu

1. FJDT (Fujitsu ATA Diagnostic Tool) v6.90 Download

FJDT is diagnostic tool to help customers speedily verifiy whether their EIDE hard disk drive is operating correctly. FJDT can diagnose suspected faulty hard drive by checking the S.M.A.R.T. data and also by scanning the entire surface of the drive, sector by sector, to verify media integrity.

2. [SDIAG] SCSI Diagnostic Tool v2.7 Download
SDIAG is a simple and reliable SCSI diagnostic tool developed by Fujitsu verifying the condition of your Fujitsu SCSI Hard Disk Drive.

3. [Ultra-ATA] Change Mode Utility v1.19 Download
A utility to change the UltraATA capability of the drive. Three batch files allow the mode setting for UDMA100, 66, and 33.

Hitachi IBM

January 2003 – IBM and Hitachi’s storage divisions merged to establish Hitachi Global Storage Technologies (Hitachi GST).

Drive Fitness Test
This download creates a self-booting DOS diskette to run the DFT utility.

Note: Currently, the Drive Fitness Test does not support Microdrives, Travelstar 8E, Travelstar 10E, or Travelstar C4K Series hard drives.

- Download Drive Fitness Test Windows Diskette Creator v4.13 b00 (05.11.2008)

- Download Drive Fitness Test v4.13 b00 (05.11.2008) – Diskette Image

- Download Drive Fitness Test v4.13 b00 (05.11.2008) – CD Image (Direct Link)

OGT Diagnostic Tool v9.0 Download
The OGT diagnostic tool is a failure analysis tool for Ultrastar 10K300, Ultrastar 15K73, and DK32XX products.
Windows version only.
The OGT will perform necessary tests to the drives and can perform failure analysis automatically.