how windows detect improper shutdown

NTDEV
1

Hi,

I just wanted to know how windows detect the improper shutdown.
Whether it sets some bits on the drive to acheive this or make use of
some registry values.

Thanks and Regards
Rakesh

2

It uses the bootstat.dat file located in the %systemroot% folder

rakesh thakur wrote: Hi,

I just wanted to know how windows detect the improper shutdown.
Whether it sets some bits on the drive to acheive this or make use of
some registry values.

Thanks and Regards
Rakesh

—
Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

---------------------------------
Brings words and photos together (easily) with
PhotoMail - it’s free and works with Yahoo! Mail.

3

Sorry for the misunderstanding. I assumed you want to know how windows detects an improper shutdown during the boot process.

First of all, what operating system are you interested in ? In case of Windows 98 for example, it uses the first 8 bytes of the FAT32.The eighth byte of the reserved area, by default, is 0F. The fourth bit of this byte is set at shutdown time. When Windows starts it checks whether that bit is 1 (proper shutdown) or 0 (bad shutdown - need to run scandisk). I have no idea how this is done in case of Windows 2000 or XP.
.
Bogdan Hobeanu wrote: It uses the bootstat.dat file located in the %systemroot% folder

rakesh thakur wrote: Hi,

I just wanted to know how windows detect the improper shutdown.
Whether it sets some bits on the drive to acheive this or make use of
some registry values.

Thanks and Regards
Rakesh

—
Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

---------------------------------
Brings words and photos together (easily) with
PhotoMail - it’s free and works with Yahoo! Mail. — Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256 To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

---------------------------------
Yahoo! Mail
Use Photomail to share photos without annoying attachments.

4

hi Bogdan

I want to know how windows detects an improper shutdown during the
boot process for Windows 2000/XP on both FAT/ NTFS Volumes.

Thanks for the reply very much.
But can i find something related to this from somewhere.
Also what bootstat.dat file contains.

Thanks in advance
Rakesh

On 3/12/06, Bogdan Hobeanu wrote:
> Sorry for the misunderstanding. I assumed you want to know how windows
> detects an improper shutdown during the boot process.
>
> First of all, what operating system are you interested in ? In case of
> Windows 98 for example, it uses the first 8 bytes of the FAT32.The eighth
> byte of the reserved area, by default, is 0F. The fourth bit of this byte is
> set at shutdown time. When Windows starts it checks whether that bit is 1
> (proper shutdown) or 0 (bad shutdown - need to run scandisk). I have no idea
> how this is done in case of Windows 2000 or XP.
> .
>
> Bogdan Hobeanu wrote:
> It uses the bootstat.dat file located in the %systemroot% folder
>
> rakesh thakur wrote:
> Hi,
>
> I just wanted to know how windows detect the improper shutdown.
> Whether it sets some bits on the drive to acheive this or make use of
> some registry values.
>
> Thanks and Regards
> Rakesh
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
>
> Brings words and photos together (easily) with
> PhotoMail - it’s free and works with Yahoo! Mail. — Questions? First check
> the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256 To unsubscribe,
> visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
>
>
> Yahoo! Mail
> Use Photomail to share photos without annoying attachments. — Questions?
> First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256 To unsubscribe,
> visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
>

5

On Windows 2000/XP autochk is executed at boot time and checks all the volumes to see if they are dirty.You can also look for information regarding FSCTL_IS_VOLUME_DIRTY in case you want to determine this yourself.

rakesh thakur wrote: hi Bogdan

I want to know how windows detects an improper shutdown during the
boot process for Windows 2000/XP on both FAT/ NTFS Volumes.

Thanks for the reply very much.
But can i find something related to this from somewhere.
Also what bootstat.dat file contains.

Thanks in advance
Rakesh

On 3/12/06, Bogdan Hobeanu wrote:
> Sorry for the misunderstanding. I assumed you want to know how windows
> detects an improper shutdown during the boot process.
>
> First of all, what operating system are you interested in ? In case of
> Windows 98 for example, it uses the first 8 bytes of the FAT32.The eighth
> byte of the reserved area, by default, is 0F. The fourth bit of this byte is
> set at shutdown time. When Windows starts it checks whether that bit is 1
> (proper shutdown) or 0 (bad shutdown - need to run scandisk). I have no idea
> how this is done in case of Windows 2000 or XP.
> .
>
> Bogdan Hobeanu wrote:
> It uses the bootstat.dat file located in the %systemroot% folder
>
> rakesh thakur wrote:
> Hi,
>
> I just wanted to know how windows detect the improper shutdown.
> Whether it sets some bits on the drive to acheive this or make use of
> some registry values.
>
> Thanks and Regards
> Rakesh
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
>
> Brings words and photos together (easily) with
> PhotoMail - it’s free and works with Yahoo! Mail. — Questions? First check
> the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256 To unsubscribe,
> visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
>
>
> Yahoo! Mail
> Use Photomail to share photos without annoying attachments. — Questions?
> First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256 To unsubscribe,
> visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
>

—
Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com

6

BOOTSTAT.DAT file IIRC keeps this flag.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “rakesh thakur”
To: “Windows System Software Devs Interest List”
Sent: Sunday, March 12, 2006 8:49 PM
Subject: [ntdev] how windows detect improper shutdown

Hi,

I just wanted to know how windows detect the improper shutdown.
Whether it sets some bits on the drive to acheive this or make use of
some registry values.

Thanks and Regards
Rakesh

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

7

> On Windows 2000/XP autochk is executed at boot time and checks all the

volumes to see if they are dirty.You can also look for information regarding
FSCTL_IS_VOLUME_DIRTY in case you want to determine this yourself.

Yes, this checks the 8 bytes in FAT boot block. But the large screen of
“Windows was not shut down correctly” is more about BOOTSTAT.DAT, then about
this.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

8

Hi,
Maxim and Bogdan.

The Bootstat.dat contains the flag for “Last Known Good Configuration
screen”. If window is not shutdown properly. This is what I wanted.

Thanks
Rakesh Thakur.

On 3/13/06, Maxim S. Shatskih wrote:
> > On Windows 2000/XP autochk is executed at boot time and checks all the
> >volumes to see if they are dirty.You can also look for information regarding
> >FSCTL_IS_VOLUME_DIRTY in case you want to determine this yourself.
>
> Yes, this checks the 8 bytes in FAT boot block. But the large screen of
> “Windows was not shut down correctly” is more about BOOTSTAT.DAT, then about
> this.
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
>
> To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
>