Windows® Internals, Sixth Edition, Part 2

EECC (error correcting code), Disk Sector Format, NAND-Type Flash Memory, PFN Data Structuresecho command, Multiple Data StreamsECP (extended create parameters), Opening DevicesEFI (Extensible Firmware Interface), Winload, Basic Disks–GUID Partition Table Partitioning, GUID Partition Table Partitioning, GUID Partition Table Partitioning, Startup and Shutdown, Boot Process, The UEFI Boot Process, The UEFI Boot ProcessAPIs, The UEFI Boot ProcessBCD in, Winloadboot process, Startup and Shutdownfile extensions, The UEFI Boot Processpartitioning and, Basic Disks–GUID Partition Table Partitioning, GUID Partition Table Partitioning, GUID Partition Table PartitioningUnified EFI (EFI 2.0), Boot ProcessEFI Boot Manager, The UEFI Boot ProcessEFI system partition, The UEFI Boot ProcessEFS (Encrypting File System), BitLocker Drive Encryption, Encryption, Encryption, File Records, Encrypting File System Security, Encrypting File System Security, Encrypting File System Security, Encrypting File System Security, Encrypting a File for the First Time, Encrypting File Data, Backing Up Encrypted FilesEFSDump utility, Backing Up Encrypted FilesEISA devices, The BIOS Boot Sector and Bootmgreject events, Structure and Operation of a KMDF DriverEKU (enhanced key usage), Encrypting File DataEl Torito CDFS, The BIOS Boot Sector and BootmgrElephant diffuser, Encryption Keys, Full-Volume Encryption Driverembedded links (OLE), Link Trackingembedded spaces (file names), File Namesemd (External Memory Device), ReadyBoostemergency hibernation files, The Power ManagerEmergency Management Services (EMS), The BIOS Boot Sector and Bootmgr, Initializing the Kernel and Executive SubsystemsEMET (Enhanced Mitigation Experience Toolkit), Controlling Security Mitigationsempty pages, Shared Memory and Mapped FilesEMS (Emergency Management Services), The BIOS Boot Sector and Bootmgrems element, The BIOS Boot Sector and Bootmgremsbaudrate element, The BIOS Boot Sector and Bootmgremsport element, The BIOS Boot Sector and Bootmgremulation (advanced format disks), Disk Sector FormatEncodeSystemPointer API, Software Data Execution PreventionEncrypted Data Recovery Agents policy, Encrypting a File for the First TimeEncryptFile function, EncryptionEncrypting File System (EFS), BitLocker Drive Encryption, Encryption, POSIX Support, File Names, Encrypting File System Security, Encrypting File System Security, Encrypting File System Security, Encrypting a File for the First Time, Encrypting a File for the First Time, Encrypting File Data, Backing Up Encrypted Filesencryption, BitLocker Drive Encryption–BitLocker To Go, BitLocker Drive Encryption, BitLocker Drive Encryption, BitLocker Drive Encryption, Encryption Keys–Trusted Platform Module (TPM), Encryption Keys, Encryption Keys, Trusted Platform Module (TPM), Trusted Platform Module (TPM), Trusted Platform Module (TPM), Trusted Platform Module (TPM), BitLocker Boot Process, BitLocker Key Recovery, Full-Volume Encryption Driver, BitLocker Management, BitLocker To Go–BitLocker To Go, BitLocker To Go, BitLocker To Go, BitLocker To Go, BitLocker To Go, ReadyBoost–Unified Caching, ReadyDrive, Unified Caching, Process Monitor, Link Tracking–Defragmentation, Encryption, Defragmentation, File Records, File Records, The Change Journal File, Encrypting File System Security–Boot Process, Encrypting File System Security, Encrypting File System Security, Encrypting File System Security, Encrypting a File for the First Time, Encrypting File Data, The Decryption Process, Backing Up Encrypted Files, Backing Up Encrypted Files, Boot Processbacking up files, Backing Up Encrypted FilesBitLocker Drive Encryption, BitLocker Drive Encryption–BitLocker To Go, BitLocker Drive Encryption, BitLocker Drive Encryption, Encryption Keys, Encryption Keys, Trusted Platform Module (TPM), Trusted Platform Module (TPM), BitLocker Boot Process, BitLocker Key Recovery, Full-Volume Encryption Driver, BitLocker Management, BitLocker To Go, BitLocker To Go, BitLocker To GoBitLocker To Go, BitLocker To Go–BitLocker To Go, BitLocker To Gochange journal and, The Change Journal Filedecryption, The Decryption ProcessEFS, BitLocker Drive Encryption, Encryption, File Records, Encrypting File System Security–Boot Process, Encrypting File System Security, Encrypting File System Security, Encrypting File System Security, Encrypting a File for the First Time, Encrypting File Data, Backing Up Encrypted Files, Boot Processfile attributes, File Recordsfile system filter drivers and, Process Monitorkeys, Encryption Keys–Trusted Platform Module (TPM), Trusted Platform Module (TPM), Trusted Platform Module (TPM)NTFS design goals, Link Tracking–Defragmentation, DefragmentationReadyBoost, ReadyBoost–Unified Caching, ReadyDrive, Unified Cachingencryption keys, Encryption Keys–Trusted Platform Module (TPM), Encryption Keys, Trusted Platform Module (TPM), Trusted Platform Module (TPM)enhanced key usage (EKU), Encrypting File DataEnhanced Mitigation Experience Toolkit (EMET), Controlling Security Mitigationsenlistment objects, Initializing the Kernel and Executive Subsystemsenumeration, Driver Objects and Device Objects, The Plug and Play (PnP) Manager, Level of Plug and Play Support–Driver Support for Plug and Play, Driver Support for Plug and Play, Driver Loading, Initialization, and Installation, The Start Value, Device Enumeration, Device Enumeration–Device Enumeration, Device Enumeration, Device Enumeration, Device Enumeration, Device Enumeration, Device Enumeration, Device Enumeration, Device Stacks, Device Stack Driver Loading, Device Stack Driver Loading, Driver Installation, The Power Manager, Basic Disk Volume Manager, VSS Operation, Heap Manager, Heap Synchronization, Indexing, Reparse Pointsdevice interfaces, Driver Objects and Device Objectsdevice keys, Device Stack Driver Loading, Driver Installationenumeration-based loading, Driver Loading, Initialization, and Installationheap entries and regions, Heap Manager, Heap Synchronizationindexing interactions, Indexingnonenumerable devices, Device EnumerationPnP loading and initialization process, Device Enumeration–Device Enumeration, Device Enumeration, Device EnumerationPnP manager, The Plug and Play (PnP) Manager, Level of Plug and Play Support–Driver Support for Plug and Play, Driver Support for Plug and Play, The Start Value, Device Enumeration, Device Enumeration, Device Enumeration, Device Stackspower management capabilities, The Power Managerregistry keys, Device Enumeration, Device Stack Driver Loadingreparse points, Reparse Pointsshadow copy writers, VSS Operationvolume manager, Basic Disk Volume Managerenumeration keys, device, Device Stack Driver Loading, Driver Installationenumeration-based loading, Driver Loading, Initialization, and Installation.enumtag command, Crash Dump Filesenvironment subsystems, The I/O Managerenvironment variables, Smss, Csrss, and Wininit, Smss, Csrss, and WininitEPROCESS structure, Crash Dump FilesERESOURCE structure, I/O Priority Inversion Avoidance (I/O Priority Inheritance), Driver Verifier, Driver Verifiererrata manager, Initializing the Kernel and Executive Subsystemserror correcting code (ECC), Disk Sector Format, PFN Data Structureserror messages (boot problems), MBR Corruption–Post–Splash Screen Crash or Hang, Boot Sector Corruption, System File Corruption, Post–Splash Screen Crash or Hangerror-logging routines, Structure of a DriverEsentutl.exe (Active Directory Database Utility tool), x86 Address Space LayoutsEthernet, Booting from iSCSIETHREAD structure, I/O Priority Inversion Avoidance (I/O Priority Inheritance), Crash Dump FilesETW (Event Tracing for Windows), Multipath I/O (MPIO) Drivers, Initializing the Kernel and Executive Subsystemsevent dispatcher objects, Page List DynamicsEvent Tracing for Windows (ETW), Multipath I/O (MPIO) Drivers, Initializing the Kernel and Executive SubsystemsEvent Viewer, Fault Tolerant Heapevents, Structure and Operation of a KMDF Driver, Structure and Operation of a KMDF Driver, In-Paging I/O–Collided Page Faults, Collided Page Faults, Memory Notification Events–Memory Notification Events, Memory Notification Events, Common Log File System, Common Log File System, Initializing the Kernel and Executive SubsystemsCLFS, Common Log File Systemin-paging I/O, In-Paging I/O–Collided Page Faults, Collided Page FaultsKDMF drivers, Structure and Operation of a KMDF DriverKDMF runtime states, Structure and Operation of a KMDF Driverlogging, Common Log File Systemmemory notification events, Memory Notification Events–Memory Notification Events, Memory Notification Eventsobject types, Initializing the Kernel and Executive Subsystemsevstore element, The BIOS Boot Sector and BootmgrEvtDeviceFileCreate event, KMDF I/O ModelEvtDriverDeviceAdd callback, Structure and Operation of a KMDF DriverEvtDriverDeviceAdd event, Structure and Operation of a KMDF DriverEvtFileCleanup callback, KMDF I/O ModelEvtFileClose callback, KMDF I/O ModelEvtIo routines, Structure and Operation of a KMDF DriverEvtIoDefault callback, KMDF I/O ModelEx functions, Services Provided by the Memory ManagerExAdjustLookasideDepth function, Look-Aside ListsExAllocatePool functions, Driver VerifierExAllocatePoolWithTag function, Driver Verifierexception codes, Software Data Execution Prevention, Causes of Windows Crashes, Causes of Windows Crashesexception handlers, Software Data Execution Preventionexceptions, Memory Manager Components, Why Does Windows Crash?, When There Is No Crash DumpEXCEPTION_DOUBLE_FAULT exception, 0x7F - UNEXPECTED_KERNEL_MODE_TRAPexclusive access locks, Locking–Locking, Locking, Lockingexclusive leases, LockingExDeleteResource function, Driver VerifierExecutable Dispatch Mitigation, Software Data Execution Preventionexecutables, Shared Memory and Mapped Files, Protecting Memory–Protecting Memory, Protecting Memory, Protecting Memory, No Execute Page Protection, User Address Space Layout, User Address Space Layoutaddress space, User Address Space Layout, User Address Space Layoutexecute-only, Shared Memory and Mapped Filesexecution protection, No Execute Page ProtectionPAGE attributes and, Protecting Memory–Protecting Memory, Protecting Memory, Protecting Memoryexecution protection, No Execute Page Protectionexecutive components, Look-Aside Lists, Section Objects, Initializing the Kernel and Executive Subsystems, Initializing the Kernel and Executive Subsystems, Shutdownexecutive objects, Initializing the Kernel and Executive Subsystemsexecutive resource locks, Hung or Unresponsive Systemsexecutive subsystems, Memory Manager Components, BIOS Preboot, Initializing the Kernel and Executive Subsystems, Initializing the Kernel and Executive Subsystems, Initializing the Kernel and Executive Subsystems, Initializing the Kernel and Executive Subsystems, Initializing the Kernel and Executive Subsystems, Initializing the Kernel and Executive Subsystems, Shutdownexecutive worker threads, System ThreadsexFAT file system, exFAT–NTFS, exFAT, NTFSExfat.sys, Local FSDsExFreePool function, Driver VerifierExInitializeNPagedLookasideList function, Look-Aside ListsExInitializePagedLookasideList function, Look-Aside ListsExitWindowsEx function, Shutdownexpanding, Balance Set Manager and Swapper–System Working Sets, System Working Sets, System Working Setsworking sets, Balance Set Manager and Swapper–System Working Sets, System Working Sets, System Working Setsexperiments, Layered Drivers–Layered Drivers, Layered Drivers, Layered Drivers, Driver Objects and Device Objects, Driver Objects and Device Objects, Driver Objects and Device Objects, Opening Devices–Opening Devices, Opening Devices, Opening Devices, Opening Devices, Fast I/O, IRP Stack Locations, IRP Stack Locations, I/O Requests to Layered Drivers–I/O Requests to Layered Drivers, I/O Requests to Layered Drivers, I/O Requests to Layered Drivers, I/O Priority Boosts and Bumps–Bandwidth Reservation (Scheduled File I/O), I/O Priority Boosts and Bumps, Bandwidth Reservation (Scheduled File I/O), Bandwidth Reservation (Scheduled File I/O), Structure and Operation of a KMDF Driver–KMDF Data Model, KMDF Data Model, KMDF Data Model, Device Stack Driver Loading, Driver Installation, Driver Installation, Driver Power Operation–Driver Power Operation, Driver Power Operation, Driver Power Operation, Power Availability Requests, Utility Function–Utility Function, Utility Function, Utility Function, Thresholds and Policy Settings–Thresholds and Policy Settings, Thresholds and Policy Settings, Thresholds and Policy Settings, Performance Check–Performance Check, Performance Check, Multipath I/O (MPIO) Drivers, The LDM Database, The LDM Database, LDM and GPT or MBR-Style Partitioning, Mirrored Volumes–Mirrored Volumes, Mirrored Volumes, Mirrored Volumes, Volume Mounting–Volume Mounting, Volume Mounting, Shadow Copy Provider, Backup, Previous Versions and System Restore, Previous Versions and System Restore–Conclusion, Conclusion, Examining Memory Usage–Examining Memory Usage, Examining Memory Usage, Examining Memory Usage, Examining Memory Usage, Reserving and Committing Pages–Reserving and Committing Pages, Reserving and Committing Pages, Reserving and Committing Pages, Shared Memory and Mapped Files, No Execute Page Protection, Monitoring Pool Usage–Look-Aside Lists, Monitoring Pool Usage, Look-Aside Lists, Look-Aside Lists, x86 Address Space Layouts, x86 Session Space–System Page Table Entries, x86 Session Space, x86 Session Space, System Page Table Entries–System Page Table Entries, System Page Table Entries, System Page Table Entries, Dynamic System Virtual Address Space Management, Dynamic System Virtual Address Space Management, User Address Space Layout–User Address Space Layout, User Address Space Layout, Controlling Security Mitigations, Page Directories, Physical Address Extension (PAE)–Physical Address Extension (PAE), Physical Address Extension (PAE), Physical Address Extension (PAE), Physical Address Extension (PAE), Page Files, User Stacks, Kernel Stacks, Process VADs, Page Frame Number Database, Page List Dynamics–Page List Dynamics, Page List Dynamics, Page List Dynamics, Page Priority, Page Priority, Page Priority, PFN Data Structures, Logical Prefetcher, Logical Prefetcher, Working Set Management, Working Set Management–Working Set Management, Working Set Management–Balance Set Manager and Swapper, Working Set Management, Working Set Management, Working Set Management, Balance Set Manager and Swapper, Process Reflection–Process Reflection, Process Reflection, Systemwide Cache Data Structures, Per-File Cache Data Structures–File System Interfaces, Per-File Cache Data Structures, File System Interfaces, Write-Back Caching and Lazy Writing–Write-Back Caching and Lazy Writing, Write-Back Caching and Lazy Writing, Write-Back Caching and Lazy Writing, Write-Back Caching and Lazy Writing, Write-Back Caching and Lazy Writing, Write-Back Caching and Lazy Writing, Forcing the Cache to Write Through to Disk–Write Throttling, Write Throttling, Write Throttling, Write Throttling, Locking–Locking, Locking, Process Monitor, Process Monitor Basic vs. Advanced Modes, Multiple Data Streams, Symbolic (Soft) Links and Junctions, Symbolic (Soft) Links and Junctions, Master File Table, File Names, The Change Journal File–The Change Journal File, The Change Journal File, Isolation–Transactional APIs, Isolation, Transactional APIs, Resource Managers–On-Disk Implementation, Resource Managers, On-Disk Implementation, Backing Up Encrypted Files, Shutdown, Crash Dump Files–Crash Dump Generation, Crash Dump Files, Crash Dump Generation, Buffer Overruns, Memory Corruption, and Special Pool, When There Is No Crash Dump–When There Is No Crash Dump, When There Is No Crash Dump, When There Is No Crash Dump, When There Is No Crash DumpASLR protection, Controlling Security Mitigationscache flushing, Forcing the Cache to Write Through to Disk–Write Throttling, Write Throttling, Write Throttlingcache manager operations, Write-Back Caching and Lazy Writing–Write-Back Caching and Lazy Writing, Write-Back Caching and Lazy Writing, Write-Back Caching and Lazy Writing, Write-Back Caching and Lazy Writing, Write-Back Caching and Lazy Writing, Write-Back Caching and Lazy Writingcatalog files, Driver Installationchange journal, The Change Journal File–The Change Journal File, The Change Journal Filecore parking policies, Thresholds and Policy Settings–Thresholds and Policy Settings, Thresholds and Policy Settings, Thresholds and Policy SettingsDEP protection, No Execute Page Protectiondevice handles, Opening Devices–Opening Devices, Opening Devices, Opening Devicesdevice name mappings, Opening Devicesdevice objects, Driver Objects and Device Objects, Driver Objects and Device Objectsdevnode information, Device Stack Driver Loadingdriver dispatch routines, IRP Stack Locationsdriver objects, Driver Objects and Device Objectsdump file analysis, Crash Dump Files–Crash Dump Generation, Crash Dump Files, Crash Dump GenerationEFS encryption, Backing Up Encrypted Filesfast I/O routines, Fast I/Ofree and zero page lists, Page List Dynamics–Page List Dynamics, Page List Dynamics, Page List Dynamicshard links, Symbolic (Soft) Links and Junctionshistory, processor utility and frequency, Utility Functionhung program timeouts, ShutdownI/O priorities, I/O Priority Boosts and Bumps–Bandwidth Reservation (Scheduled File I/O), I/O Priority Boosts and Bumps, Bandwidth Reservation (Scheduled File I/O), Bandwidth Reservation (Scheduled File I/O)idle system activity, Process Monitor Basic vs. Advanced ModesINF files, Driver InstallationIRPs, I/O Requests to Layered Drivers–I/O Requests to Layered Drivers, I/O Requests to Layered Drivers, I/O Requests to Layered Driverskernel debugging, When There Is No Crash Dump–When There Is No Crash Dump, When There Is No Crash Dump, When There Is No Crash Dump, When There Is No Crash Dumpkernel stack usage, Kernel StacksKMDF drivers, Structure and Operation of a KMDF Driver–KMDF Data Model, KMDF Data Model, KMDF Data Modellarge address aware applications, x86 Address Space LayoutsLDM database, The LDM Database, The LDM Database, LDM and GPT or MBR-Style Partitioningloaded driver lists, Layered Drivers–Layered Drivers, Layered Drivers, Layered Driversmapping volume shadow device objects, Previous Versions and System Restore–Conclusion, Conclusionmaximum number of threads, User Stacksmemory mapped files, Shared Memory and Mapped Filesmirrored volume I/O, Mirrored Volumes–Mirrored Volumes, Mirrored Volumes, Mirrored VolumesNTFS volume information, Master File TablePAE and addresses, Physical Address Extension (PAE)–Physical Address Extension (PAE), Physical Address Extension (PAE), Physical Address Extension (PAE), Physical Address Extension (PAE)page directories and PDEs, Page Directoriespage files, Page FilesPFN database, Page Frame Number DatabasePFN entries, PFN Data Structuresphysical disk I/O, Multipath I/O (MPIO) Driverspool leaks, Monitoring Pool Usage–Look-Aside Lists, Monitoring Pool Usage, Look-Aside Listspower availability requests, Power Availability RequestsPPM check information, Performance Check–Performance Check, Performance Checkprefetch files, Logical Prefetcher, Logical Prefetcherprioritized standby lists, Page Priority, Page Priority, Page PriorityProcess Monitor’s filter driver, Process Monitorprocess reflection, Process Reflection–Process Reflection, Process Reflectionprocess working sets, Working Set Managementprocessor utility and frequency, Utility Function–Utility Function, Utility Functionreserved and committed pages, Reserving and Committing Pages–Reserving and Committing Pages, Reserving and Committing Pages, Reserving and Committing Pagesresource manager information, Resource Managers–On-Disk Implementation, Resource Managers, On-Disk Implementationrestore points and previous versions, Previous Versions and System Restoresession space utilization, x86 Session Spacesessions, x86 Session Space–System Page Table Entries, x86 Session Space, System Page Table Entriesshadow copy device objects, Shadow Copy Providershadow volume device objects, Backupshared and private cache maps, Per-File Cache Data Structures–File System Interfaces, Per-File Cache Data Structures, File System Interfacesspecial pool, Buffer Overruns, Memory Corruption, and Special Poolstreams, Multiple Data Streamssymbolic links, Symbolic (Soft) Links and Junctionssystem look-aside lists, Look-Aside Listssystem memory information, Examining Memory Usage–Examining Memory Usage, Examining Memory Usage, Examining Memory Usage, Examining Memory Usagesystem power and policies, Driver Power Operation–Driver Power Operation, Driver Power Operation, Driver Power Operationsystem PTEs, System Page Table Entries–System Page Table Entries, System Page Table Entriessystem virtual address usage, Dynamic System Virtual Address Space Managementthread IRPs, IRP Stack Locationstransactions, Isolation–Transactional APIs, Isolation, Transactional APIstunneling, File Namesuser virtual address space, User Address Space Layout–User Address Space Layout, User Address Space LayoutVACBs, Systemwide Cache Data Structuresviewing registered file systems, Locking–Locking, Lockingvirtual address descriptors, Process VADsvirtual address limits, Dynamic System Virtual Address Space ManagementVPBs, Volume Mounting–Volume Mounting, Volume Mountingworking set lists, Working Set Management–Balance Set Manager and Swapper, Working Set Management, Balance Set Manager and Swapperworking sets vs. virtual size, Working Set Management–Working Set Management, Working Set Management, Working Set Managementwrite throttling, Write Throttlingexplicit device driver loading, The Start Valueexplicit file I/O, Explicit File I/O–Cache Manager’s Read-Ahead Thread, Explicit File I/O, Explicit File I/O, Explicit File I/O, Explicit File I/O, Cache Manager’s Read-Ahead Threadexplicit memory allocation, Driver Verifierexportascd element, The BIOS Boot Sector and Bootmgrexporting control sets, Post–Splash Screen Crash or Hangexpress queues (cache), System Threadsextended attributes, File Records, The Change Journal Fileextended console input, The BIOS Boot Sector and Bootmgrextended create parameters (ECP), Opening DevicesExtended File Allocation Table file system (exFat), exFAT–NTFS, NTFS, NTFSextended partitions, MBR-Style Partitioning, BIOS Prebootextendedinput element, The BIOS Boot Sector and Bootmgrextending data, Sparse Filesextensibility, I/O System Componentsextents (runs), Resident and Nonresident Attributesexternal disk storage management, Storage ManagementExternal Memory Device (emd), ReadyBoost