NTLDR

How many times has it happened with you that you have seen an error message which reads something like this:

NTLDR missing... If you have had a computer for sometime then I am sure you must have seen this message at least once. I discuss here what exactly is NTLDR.

NTLDR stands for NT loader. This is the boot loader for all NT versions of Microsoft Windows and these versions include Windows XP and Windows Server 2003. In most cases where an OS is already installed on the computer, NTLDR runs from the primary HDD installed on the computer, but it can also run from various portable media such as a USB drive, CD ROM drive, Floppy disk etc. It can also load a non-NT based OS provided the correct boot sector in the file. For NTLDR to run, there are two files that are essentially required. They are:

1. boot.ini: This file contains the configurations for booting and contains the boot menu
2. NTLDR: this contains the main boot loader program itself.

When both these files are found by NTLDR, it carries on the following functions:

1. It first accesses the file system (FAT or NTFS).
2. Now there can be two cases when you last stopped working on your PC. You could either have hibernated the PC or have shut it down. In case you Hibernated, NTLDR will access the file hiberfil.sys and starts the system from where the last configurations were saved.
3. If not, then it searches the boot.ini and then displays the boot menu.
4. If you chose a non-NT based OS from the boot menu, NTLDR loads the associated file and lets it carry on the operation from there on.
5. If you select an NT-based OS, ntdetect.com is chosen. This tests and gathers information about the different hardware units installed.
6. Then the control is transferred to a file called ntoskrnl.sys by passing all information gathered by ntdetect.com to this file.

ntoskrnl.sys : This file is the kernel image for the family of all Windows NT OSs. It provides the kernel and executive layers of the Windows NT kernel space. Various functions of this file include hardware virtualization, process and memory management etc.