Important Windows Files Folders and Tools
Author: Jialong He
[email protected] http://www.bigfoot.com/~jialong_he
loads Ntoskrnl.exe, Bootvid.dll, Hal.dll, and boot-start device drivers. Boot.ini Contains options for starting the version of Windows that Setup installs and any preexisting Windows installations. After the boot selection is made, Ntldr loads and executes this 16-bitreal-mode program to query the computer for basic device and configuration information. This information includes the following: · The time and date information stored in the system’s CMOS (nonvolatile memory). · The types of buses (for example, ISA, PCI, EISA, Micro Channel Architecture [MCA]) on the system and identifiers for devices attached to the buses. · The number, size, and type of disk driveson the system. · The types of mouse input devices connected to the system. · The number and type of parallel ports configured on the system. Contains memory data that Windows is unable to fit into physical RAM. During Startup, the virtual memory manager moves data in and out of the paging file to optimize the amount of physical memory available to the operating system and applications. If eitherthe boot or system drives are SCSI-based, Ntldr loads this file and uses it instead of the bootcode functions for disk access.
Wizard CSC Cursors Debug Downloaded Program Files Driver Cache Fonts Help Ime ime (x86) Java Media MS Msagent
computer starts Windows for the first time Offline files that are used during client-side caching Cursor and icon files Log files Downloaded program filesUninstalled driver files All font files Help files Language files Language files for x86-based systems Java files Sound and music files (for example: *.wav and *.midi) Installation folder for Microsoft® Systems Management Server (SMS) client Microsoft Agent files (Microsoft Agent is a set of programmable software services that support the presentation of interactive animated characters within theMicrosoft® Windows® interface) Files that support backward compatibility in applications Multi-user interface files Downloaded Web pages for offline reading Help and Support Center files Data files related to enhancing the speed at which applications start COM+ files. COM+ files are enhancements to the Microsoft Component Object Model (COM) Registry backup files (these files are updated if youuse NTBackup and choose to back up system state files) User interface files Schema cache folder Log files, templates for snap-ins, and security database files Dynamic Update storage location Search assistant files Backward compatibility files related to the System folder (for example, applications that look for a System folder) Core operating system files (for more information, see “System32Folder” later in this appendix) Scheduled Task files Temporary files
Ntdetect.com
Time Synchronization Time Service
On Window NT4, use “TimeServ” from Windows NT Server 4.0 Resource Kit (timeserv.exe, timeserv.dll in c:winntsystem32 and timeserv.ini in c:winnt) On Win2k, W32Time server is preinstalled. Default sync time with domain controller. To make it sync with external NTP server, nettime /setsntp:”192.5.41 209 192.5.41.41” This make registry change in HKLMSYSTEMCurrentControlSet ServicesW32TimeParameters Type=NTP NtpServer=192.5.41.209 192.5.41.41 Other parameters include: ReliableTimeSource, TimeSource, Sync workstation with Windows time server net time imeserver /set /yes Ntbootdd.sys Pagefile.sys
Msapps Mui
Default Local Disk Folders File Name DescriptionsDocuments and Settings Account information for each user who is granted access on the computer. Each user account is represented by a subfolder assigned the user name. Folders under each user account folder include My Documents, Desktop, and Start Menu. Installed applications, such as Microsoft® Internet Explorer or Microsoft® Office. Entire operating system.
Offline Web Pages PCHEALTH Prefetch…
