#dfir

Over the course of this year I have explained to colleagues and clients who’s roles are not in Cybersecurity what certain phrases or abbreviations mean. After I while I started to drop them into a word document so I could reuse them. Then I decided to make this post so I can easily share the explanations. There are bound to be things missing, please drop a comment if I have missed something and…

Supported file format:

Object Linking and Embedding Compound Files - (Microsoft Office 97-2003 DOC, XLS, PPT and any embedded into Microsoft Office files objects)

Office Open XML Files - (Microsoft Office 2007+ DOCX, PPTX (Partial Support))

Rich Text Format - (.RTF)

Shell Link Binary File Format - (.LNK)

Files in the abovementioned formats can be submitted compressed in the following archive types:

ZIP - (.ZIP) Password ' infected' is supported.

GZIP - (.GZ)

When a Windows machine powers on, a complex, low-level choreography unfolds within seconds. For security operations center (SOC) analysts, incident responders, and system administrators, understanding this sequence is not just academic it is foundational for detecting rootkits, diagnosing boot loops, and conducting deep digital forensics. The entire Windows startup sequence flows through four distinct, sequential phases: the Pre-boot phase, the Windows Boot Manager phase, the Operating System Loader phase, and the Kernel Initialization phase.

During this transition from bare-metal hardware to a fully functional operating system, control is handed off systematically. The system moves from firmware execution to configuration parsing, then to driver loading, and finally to the initialization of the subsystem processes that manage user sessions. If a malicious driver or unauthorized configuration change is introduced at any point in this chain, the entire integrity of the operating system is compromised.

Detailed Deep Dive into the Startup Stages

1. Pre-Boot Phase

The moment you press the power button, the motherboard's power supply unit conducts a Power-On Self-Test (POST) to verify peripheral connectivity, memory health, and essential hardware functionality. Once the POST completes successfully, control is handed over to the system firmware, which will be either legacy BIOS (Basic Input Output System) or modern UEFI (Unified Extensible Firmware Interface).

The primary job of the firmware is to locate the system boot device based on the priority configured in the NVRAM or CMOS settings.

Legacy BIOS: Looks for the Master Boot Record (MBR) located on the first sector of the bootable drive, executes it, and passes control.

Modern UEFI: Bypasses the fragile MBR sector entirely. Instead, it reads the GUID Partition Table (GPT) to locate the dedicated EFI System Partition (ESP), which contains standard executable boot files.

2. Windows Boot Manager Phase

Once the firmware identifies the correct boot path, it launches the Windows Boot Manager application. In legacy systems, this file is named BOOTMGR and resides in the root of the active partition. On modern UEFI systems, it is an EFI application executable named bootmgfw.efi, located within the EFI System Partition.

The Boot Manager acts as the orchestrator. Its primary responsibility is reading the Boot Configuration Data (BCD) store, a database containing system startup parameters, boot menus, and timeout settings. If a machine has multiple operating systems installed, the Boot Manager presents the boot menu to the user. Once the target Windows installation is selected (or chosen by default), the Boot Manager locates and launches the specific OS loader.

3. Operating System Loader Phase

With the boot parameters mapped, control shifts to the Windows Operating System Loader. Depending on your firmware architecture, this executable is either winload.exe (BIOS) or winload.efi (UEFI).

The OS Loader performs several critical security and stability checks:

It initializes the Early Launch Anti-Malware (ELAM) drivers to ensure third-party drivers are scanned before execution.

It reads the registry SYSTEM hive from disk into memory to identify which device drivers are marked with a Start Type of 0, meaning they are essential for the core system to function.

It loads these essential boot-start drivers into RAM but does not execute them yet.

It loads the foundational kernel binary file, ntoskrnl.exe, along with the Hardware Abstraction Layer (hal.dll).

Once everything is staged in physical memory, the loader turns off memory paging and hands full execution control over to the kernel.

4. Kernel Initialization Phase

The ntoskrnl.exe binary takes control and initializes the Windows executive subsystems, including memory management, security references, and process handling. The Hardware Abstraction Layer (HAL) is brought online to insulate the kernel code from specific motherboard chipsets.

Next, the kernel executes the boot-start drivers that the loader previously staged in memory. It then scans the registry for System Start drivers (Start Type 1) and brings them online.

With the core kernel running, control transitions from kernel space to user space via the following chain:

The Session Manager (smss.exe) establishes the initial user environment, creates Session 0 for background services, and creates Session 1 for the interactive user. It launches wininit.exe to start vital background infrastructure like the Service Control Manager (services.exe) and the Local Security Authority Subsystem (lsass.exe). Finally, it spins up winlogon.exe, which brings up the familiar graphical user interface and user login screen.

How to Troubleshoot and Analyze Windows Boot Issues

When a Windows machine fails to reach the login screen, professionals must use a structured isolation methodology to pinpoint the failure stage.

1.Trigger Advanced Boot Options:Isolate Hardware vs. Software.

Force the system into the Windows Recovery Environment (WinRE) by interrupting the boot process three consecutive times, or boot from a verifiable installation media. Select Advanced Options to access command-line and recovery tools.

2.Inspect and Rebuild the Boot Configuration Data:Fix Boot Manager Issues.

Open the Command Prompt from WinRE. Run bootrec /fixmbr and bootrec /fixboot to repair basic boot sector redirection. Follow up with bootrec /rebuildbcd to scan all disks for Windows installations and rebuild an uncorrupted BCD database.

3.Enable Boot Logging via MSCONFIG:Isolate Driver Failures.

If the system can boot into Safe Mode, open the System Configuration tool by typing msconfig in the Run dialog. Navigate to the Boot tab, check the "Boot log" option, and restart the machine. This forces Windows to track every driver initialization attempt.

4.Analyze the Boot Log File:Identify the Root Cause.

Navigate to the Windows system directory (usually C:\Windows) and open the file named ntbtlog.txt. Scroll to the bottom of the log to find the last driver listed as "Loaded" or locate the drivers explicitly flagged as "Did not load". This reveals exactly which storage, file-system, or third-party filter driver is causing the system to crash.

Elevating Your Internal Analysis Skills with InfosecTrain

Mastering low-level Windows internals, memory structures, and boot sequences is an absolute necessity for modern security professionals. When an advanced persistent threat (APT) deploys a bootkit or modifies registry startup paths to maintain persistence, a surface-level understanding of Windows will not cut it. Security analysts must know exactly what standard system behavior looks like to spot anomalies instantly.

At InfosecTrain, we offer comprehensive, hands-on training programs designed to bridge the gap between basic administration and advanced security engineering. Our courses—including the SOC Analyst Training, Certified Incident Handler (ECIH), and Digital Forensics programs—delve deep into artifact analysis, memory forensics, and operating system mechanics. Through practical labs and real-world threat simulations led by experienced industry instructors, you will learn how to audit system initialization, hunt for hidden persistence mechanisms, and handle complex security incidents with confidence.

Frequently Asked Questions

What is the main difference between BIOS and UEFI during system startup?

BIOS relies on execution of real-mode code stored on the physical MBR sector of a drive, limiting partition sizes and boot options. UEFI runs in protected mode, reads partition tables natively via GPT, loads dedicated EFI executable files, and supports modern security features like Secure Boot before any OS components run.

Where does Windows store its boot configuration parameters?

Windows stores these parameters in the Boot Configuration Data (BCD) registry-format hive file. On UEFI systems, this file is located inside the hidden EFI System Partition under the path EFI\Microsoft\Boot\BCD. On legacy BIOS systems, it is located in the active partition's Boot folder.

What triggers a Windows Blue Screen of Death (BSOD) during the boot process?

A boot-time BSOD occurs when a critical boot-start driver or a core system file (like ntoskrnl.exe) becomes corrupted, unreadable, or encounters an unhandled exception. This often happens if a storage controller driver fails to initialize, preventing the kernel from mounting the main operating system partition.

How does Secure Boot protect the system initialization phase from malware?

Secure Boot is a UEFI framework feature that validates the digital signature of every piece of boot software, including firmware drivers, option ROMs, and the Windows OS Loader. If a signature is missing or altered by a rootkit, the system firmware refuses to execute the file, blocking the threat before it can run.

Which system process is responsible for launching the user login screen?

The Windows Logon Application, known as winlogon.exe, is responsible for launching the interactive user login interface. It is spawned by the Session Manager (smss.exe) and coordinates with the Local Security Authority Subsystem (lsass.exe) to authenticate user credentials safely.

Read Our Source Blog: The Stages of the Windows Boot Process