based upon archives and my experiments I learnt that bootstat.dat (under \boot\ partition and under boot parition c:\boot) are modified during bios time.
Now these files need to be written/read during windows time also. To verify this I used a disk class upper filter to filter the access to these files . But I do not see the access to these files during windows time. I obtain the physical sectors of these files using nfi.exe.
Any help on what I may be doing wrong? Thank you.
xxxxx@gmail.com wrote:
based upon archives and my experiments I learnt that bootstat.dat (under \boot\ partition and under boot parition c:\boot) are modified during bios time.
You mean c:\windows, right? There’s no c:\boot in a standard Windows
system.
> Now these files need to be written/read during windows time also. To verify this I used a disk class upper filter to filter the access to these files . But I do not see the access to these files during windows time. I obtain the physical sectors of these files using nfi.exe.
>
> Any help on what I may be doing wrong?
Why do you think it needs to be read/written during Windows time? Other
that boot and shutdown, I doubt the file is ever touched.
–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.
>> You mean c:\windows, right? There’s no c:\boot in a standard Windows
system.
No I meant c:\boot\bootstat.dat. But thank you for pointing out, I do see one under c:\windows\ also.
> Why do you think it needs to be read/written during Windows time? Other
that boot and shutdown, I doubt the file is ever touched.
Sorry for being not clear. windows time means non-bios time and that includes windows shutdown also :-). During shutdown my disk upper filter should be able to see it. right?
Thanks Tim. the correct file sectors to filter is c:\windows\bootstat.dat. Now I see access to it in my filter driver. Also this file does get accessed (read/written) several times from boot to shutdown.