Windows® Internals, Sixth Edition, Part 2

RR handles, Lockingrace conditions, Hardware vs. Software Write Bits in Page Table Entries, Buffer Overruns, Memory Corruption, and Special PoolRADAR (Windows Resource Exhaustion Detection and Resolution), Process Reflection, Process ReflectionRAID-5 volumes, Dynamic Disks, Data Redundancy and Fault Tolerance, NTFS Bad-Cluster RecoveryRAM, I/O Priorities, Solid State Disks, Examining Memory Usage, Page Files, Commit Charge and the System Commit Limit, Commit Charge and the System Commit Limit, Commit Charge and the System Commit Limit, Commit Charge and Page File Size, Commit Charge and Page File Size, Working Set Management, Why Does Windows Crash?, Buffer Overruns, Memory Corruption, and Special Poolcommit charge, Commit Charge and the System Commit Limit, Commit Charge and the System Commit Limit, Commit Charge and the System Commit Limitcorruption, Why Does Windows Crash?DMA errors, Buffer Overruns, Memory Corruption, and Special PoolI/O priorities, I/O Prioritiespage files, Page Files, Commit Charge and Page File Size, Commit Charge and Page File Sizeusage, Examining Memory Usageviewing working sets, Working Set Managementvs. flash memory, Solid State Disksramdiskimagelength element, The BIOS Boot Sector and Bootmgrramdiskimageoffset element, The BIOS Boot Sector and Bootmgrramdisksdipath element, The BIOS Boot Sector and Bootmgrramdisktftpblocksize element, The BIOS Boot Sector and Bootmgrramdisktftpclientport element, The BIOS Boot Sector and Bootmgrramdisktftpwindowsize element, The BIOS Boot Sector and BootmgrRAMMap utility, Examining Memory Usage, Page List Dynamics, Page List Dynamics, Page List Dynamics, Page List Dynamics, Page List Dynamics, Page List Dynamicsrandom I/O, Opening Devices, ReadyBoostrandom number generation, Trusted Platform Module (TPM), The BIOS Boot Sector and Bootmgrrandomization (block metadata), Heap Security FeaturesRAW disks, The BIOS Boot Sector and BootmgrRAW file system driver, Volume Mounting, Local FSDsraw traces and logs, Tracing and LoggingRDBSS (Redirected Drive Buffering Subsystem), Remote FSDsRdyboost.sys (ReadyBoost), ReadyBoostread operations, IRP Buffer Management, I/O Priority Boosts and Bumps, KMDF I/O Model, Mirrored Volumes–Mirrored Volumes, Mirrored Volumes, VSS Operation, In-Paging I/O, Clustered Page Faults–Page Files, Clustered Page Faults, Page Files, Section Objects, Unified Caching, File System Interfaces, Fast I/O, Fast I/O, File Record Numbers, Transactional APIs, Log File Service, Crash Dump Analysisbuffered I/O, IRP Buffer Managementcached and noncached versions, File System Interfacescopies of files in memory, Section Objectscrashes, Crash Dump Analysisfast I/O, Fast I/O, Fast I/Ofile attributes, File Record Numbersfile handles, Transactional APIsin-paging I/O, In-Paging I/OKMDF, KMDF I/O ModelLFS log files, Log File Servicemirrored volumes, Mirrored Volumes–Mirrored Volumes, Mirrored Volumespaging files, I/O Priority Boosts and Bumpsprefetched pages, Clustered Page Faults–Page Files, Clustered Page Faults, Page FilesReadyBoost, Unified Cachingshadow copies, VSS Operationread-ahead operations, Fast I/O, Intelligent Read-Ahead, Locking–Locking, Locking, Cache Manager’s Lazy Writer, Memory Manager’s Page Fault Handler, Compressing Nonsparse Dataasynchronous with history, Intelligent Read-Aheadcache manager work requests, Cache Manager’s Lazy Writer, Memory Manager’s Page Fault Handlercompressed files, Compressing Nonsparse Datafast I/O, Fast I/Ooplocks, Locking–Locking, Lockingread-commited isolation, Isolation–Isolation, Isolation, Isolationread-in-progress bits, Collided Page Faultsread-in-progress PFN flag, PFN Data Structuresread-isolation rules, Transactional APIsread-modify-write operations, Disk Sector Formatread-only file attributes, File Recordsread-only memory, Page Frame Number Database, Why Does Windows Crash?, Code Overwrite and System Code Write Protectionread-only status, Large and Small Pages, Address Windowing Extensions, Page Tables and Page Table Entries, Physical Address Extension (PAE), Page Fault Handlingread/write access, Large and Small Pages, Address Windowing ExtensionsReadDirectoryChanges API, Transactional APIsReadDirectoryChangesW function, Process Monitor Basic vs. Advanced ModesReadEncryptedFileRaw function, Backing Up Encrypted FilesReadFile function, Explicit File I/O, Transactional APIsReadFileEx function, Completing an I/O RequestReadFileScatter function, Scatter/Gather I/OReadProcessMemory function, Reserving and Committing PagesReadyBoost, ReadyBoost, ReadyBoost, ReadyBoost, exFAT, ReadyBoot, ReadyBootReadyBoot, ReadyBoot–ReadyBoot, ReadyBoot, ReadyBootReadyDrive, ReadyBoost–Unified Caching, Unified Cachingreal boot mode, The BIOS Boot Sector and Bootmgr, The BIOS Boot Sector and Bootmgrreason callbacks, The Blue Screenrebalancer, Components, Tracing and Logging, Page Priority and Rebalancing, Page Priority and Rebalancingreciprocals, Initializing the Kernel and Executive Subsystemsrecognizing volumes, File System Driver Architecturerecord offsets (LSNs), Log Sequence Numbersrecording utility values, Performance Checkrecords, NTFS file, File Record Numbers–File Names, File Records, File Records, File Namesrecoverable file systems, Key Features of the Cache Manager, Recoverable File System Support, Design, Designrecovery, Striped Volumes, RAID-5 Volumes, Recoverable File System Support, NTFS Design Goals and Features, Recoverability, Master File Table, Logging Implementation, Recovery Implementation, NTFS Recovery Support, NTFS Recovery Support, Metadata Logging, Log File Service, Log Record Types, Log Record Types, Log Record Types, Recovery–NTFS Bad-Cluster Recovery, Recovery–NTFS Bad-Cluster Recovery, Recovery, Recovery, Analysis Pass–Undo Pass, Redo Pass, Redo Pass, Redo Pass, Redo Pass, Redo Pass, Undo Pass–NTFS Bad-Cluster Recovery, Undo Pass, Undo Pass, Undo Pass, Undo Pass, Undo Pass, Undo Pass, Undo Pass, NTFS Bad-Cluster Recovery, NTFS Bad-Cluster Recovery, NTFS Bad-Cluster Recovery, NTFS Bad-Cluster Recovery, NTFS Bad-Cluster Recovery, NTFS Bad-Cluster Recovery, Self-Healing, Self-Healinganalysis pass, Analysis Pass–Undo Pass, Redo Pass, Undo Passdisk recovery, Recovery–NTFS Bad-Cluster Recovery, Recovery, Redo Pass, Undo Pass, Undo Pass, NTFS Bad-Cluster Recoveryimplementation, Recovery Implementationlog file passes, Recovery–NTFS Bad-Cluster Recovery, Redo Pass, Undo Pass, Undo Pass, NTFS Bad-Cluster Recoverylog files (, Recoverable File System Support, Master File TableNTFS recoverability, NTFS Design Goals and Features, Recoverability, NTFS Recovery Support, NTFS Recovery Support, Metadata Logging, Log File Service, Log Record Types, Log Record Types, Log Record Types, Recovery, Redo Pass, Undo Pass, Undo Pass, NTFS Bad-Cluster Recovery, NTFS Bad-Cluster Recovery, NTFS Bad-Cluster Recovery, Self-HealingRAID-5 recoverability, RAID-5 Volumesredo pass, Redo Passself-healing, Self-Healingstriped volumes, Striped VolumesTxF process, Logging Implementationundo pass, Undo Pass–NTFS Bad-Cluster Recovery, NTFS Bad-Cluster Recoveryrecovery agents, Encrypting a File for the First Time, Encrypting a File for the First Time, Encrypting File Datarecovery keys, Trusted Platform Module (TPM), BitLocker Key Recovery, BitLocker To Gorecovery partitions, Windows Recovery Environment (WinRE)recovery sequence (BCD), The BIOS Boot Sector and Bootmgrrecoveryenabled element, The BIOS Boot Sector and Bootmgrrecoverysequence element, The BIOS Boot Sector and Bootmgrrecursive callouts, Kernel Stacksrecursive faults, When There Is No Crash Dumpredirectors, Remote FSDs, NTFS File System Driverredo entries, Log Record Types, Log Record Typesredo pass, Recovery Implementation, Log File Service, Analysis Passredo records, Logging Implementationredundant volumes, NTFS Bad-Cluster Recoveryreference counts, Modified Page Writer, PFN Data Structures, PFN Data Structuresreferenced directory traces, Logical Prefetcherreferenced file traces, Logical PrefetcherRegedit utility, Post–Splash Screen Crash or Hangregions, FAT12, FAT16, and FAT32, Log BlocksCLFS, Log BlocksFAT, FAT12, FAT16, and FAT32registered device driver bugcheck callbacks, When There Is No Crash Dumpregistered drivers, Layered Drivers, Layered Drivers, Volume Mounting, Local FSDs, Lockingregisters, Synchronizationregistry, I/O System Components, KMDF Data Model, Driver Loading, Initialization, and Installation–The Start Value, The Start Value, The Start Value, Device Enumeration, Device Stacks, Device Stack Driver Loading, Device Stack Driver Loading, Device Stack Driver Loading, Device Stack Driver Loading, Driver Installation, Thresholds and Policy Settings–Thresholds and Policy Settings, Thresholds and Policy Settings, Thresholds and Policy Settings, Winload, Partition Manager, The Mount Manager, Virtual Disk Service, Large and Small Pages, x86 Address Space Layouts, System Page Table Entries, System Virtual Address Space Quotas, Page Files–Page Files, Page Files, Page Files, Driver Verifier, Logical Prefetcher, Memory Notification Events, Cache Virtual Size, Troubleshooting File System Problems, Self-Healing, Smss, Csrss, and Wininit, Last Known Good, Last Known Good, Driver Loading in Safe Mode, Driver Loading in Safe Mode, Driver Loading in Safe Mode, Troubleshooting Crashes, Crash Dump Files, Crash Dump Files, Code Overwrite and System Code Write Protectionboot process, Winloadcache virtual size, Cache Virtual Sizecomplete crash dump enabling, Crash Dump Filesdeciphering driver names, Troubleshooting Crashesdevice driver identification and loading, Device Stacks, Device Stack Driver Loading, Device Stack Driver Loading, Device Stack Driver Loading, Driver Installation, Last Known Good, Driver Loading in Safe Mode, Driver Loading in Safe ModeDriver Verifier values, Driver Verifierenumeration keys, Device Enumeration, Device Stack Driver Loadingforcing high memory addresses, x86 Address Space Layoutshigh and low memory values, Memory Notification EventsI/O system, I/O System Componentsinitializing, Smss, Csrss, and WininitKMDF object keys, KMDF Data Modellarge page size key, Large and Small Pageslast known good settings, Last Known Goodlists of page files, Page Files–Page Files, Page Files, Page Filesloading drivers and services, Driver Loading, Initialization, and Installation–The Start Value, The Start Value, The Start ValueMemory.dmp file options, Crash Dump Filesmounted device letters, The Mount Managerpartitions, Partition Managerper-user quotas, System Virtual Address Space Quotasprefetch settings, Logical Prefetcherprocessor thresholds and policy settings, Thresholds and Policy Settings–Thresholds and Policy Settings, Thresholds and Policy Settings, Thresholds and Policy Settingsself-healing entries, Self-Healingservice configuration keys, Driver Loading in Safe Modesystem code write protection, Code Overwrite and System Code Write Protectiontracking PTEs, System Page Table Entriestroubleshooting issues, Troubleshooting File System ProblemsVDS information, Virtual Disk Serviceregistry hive files, BitLocker Drive Encryption–BitLocker To Go, BitLocker To Go, Smss, Csrss, and Wininit, System Hive Corruptionencryption, BitLocker Drive Encryption–BitLocker To Go, BitLocker To Goloading user set, Smss, Csrss, and WininitSYSTEM hive, System Hive Corruptionregular queues (cache management), System Threadsrelative paths, Symbolic (Soft) Links and Junctionsreleasing address space, Reserving and Committing Pagesrelocatephysical element, The BIOS Boot Sector and Bootmgrremapping bad sectors, NTFS Bad-Cluster Recoveryremote boot debugging, The BIOS Boot Sector and Bootmgrremote disks, booting from, Booting from iSCSIremote file replication services, File System Filter Driversremote FSDs, Remote FSDs–File System Operation, Remote FSDs, File System Operationremovable devices, The Mount Manager, Volume Mountingremoval requested PFN flag, PFN Data Structuresremove command, Driver Support for Plug and Play–The Start Value, The Start Valueremove/eject device utility, Driver Support for Plug and Playremovememory element, The BIOS Boot Sector and BootmgrRemoveUsersFromEncryptedFile function, Backing Up Encrypted Filesrename APIs, Transactional APIsrenaming files, Sparse Files, Smss, Csrss, and Wininitrepair installations, System File Corruptionrepairing, Windows Recovery Environment (WinRE)–MBR Corruption, Windows Recovery Environment (WinRE), MBR Corruptioninstallation, Windows Recovery Environment (WinRE)–MBR Corruption, Windows Recovery Environment (WinRE), MBR Corruptionreparse data, Symbolic (Soft) Links and Junctionsreparse point files (, Master File Table, Reparse Pointsreparse points, Mount Points, Symbolic (Soft) Links and Junctions, File Records, The Change Journal File, Reparse Pointsreparse tags, Symbolic (Soft) Links and Junctions, Reparse Pointsreplacement policies, Placement Policy–Working Set Management, Placement Policy, Working Set Managementreplication agents, Common Log File Systemreporting errors, Windows Error Reporting, Windows Error Reportingrepurpose counts, Page Priorityreserve cache, Examining Memory Usagereserved pages, Reserving and Committing Pages, Reserving and Committing Pages, Reserving and Committing Pages, Allocation Granularity, Allocation Granularity, Pageheapreserving and committing pages, Reserving and Committing Pages–Reserving and Committing Pages, Reserving and Committing Pages, Reserving and Committing Pages, Reserving and Committing Pagesresident pages, faults, Page Fault Handlingresident shared pages, Reserving and Committing Pagesresident size of paged pool, Pool Sizesresolution (BCD elements), The BIOS Boot Sector and Bootmgrresolution settings (video), Smss, Csrss, and Wininitresource allocation (PnP), The Plug and Play (PnP) Managerresource arbitration (PnP), The Plug and Play (PnP) Manager, Driver Support for Plug and Playresource lists (KMDF), KMDF Data Modelresource manager objects, Initializing the Kernel and Executive Subsystemsresource managers, Resource Managers, Resource Managers, Resource Managers, Recovery Implementationresource range lists (KMDF), KMDF Data Modelresource requirements lists (KMDF), KMDF Data Modelrestart area (LFS), Log File Service, Log File Servicerestart LSNs, Log Sequence Numbers, Recovery Implementationrestart records, Logging Implementationrestore points, Previous Versions and System Restore, Windows Recovery Environment (WinRE), System File Corruption, System File Corruption, Post–Splash Screen Crash or Hangrestoring previous versions, Previous Versions and System Restore–Previous Versions and System Restore, Previous Versions and System Restore, Previous Versions and System Restore, Previous Versions and System Restorerestrictapiccluster element, The BIOS Boot Sector and Bootmgrresumeobject element, The BIOS Boot Sector and Bootmgr, The BIOS Boot Sector and BootmgrRetrieve API, KMDF Data ModelRH (Read-Handle) handles, LockingRivest-Shamir-Adleman (RSA), Encrypting File System SecurityRMs (resource managers), Resource Managersrobust performance, Robust Performance–Robust Performance, Robust Performance, Robust Performancerobusted pages, Robust Performance–Robust Performance, Robust Performance, Robust Performancerocket model (PPM), Increase/Decrease Actions, Performance Checkrollback operations, RecoverabilityRom PFN flag, PFN Data StructuresRom PFN state, Page Frame Number DatabaseRoot bus driver, Device Enumerationroot directories, FAT12, FAT16, and FAT32, Encryption, Master File Tablerotate VADs, Rotate VADsrotating magnetic disks, Disk Devices–NAND-Type Flash Memory, Solid State Disks, NAND-Type Flash Memoryrotational latency, ReadyBoostRSA (Rivest-Shamir-Adleman), Encrypting File DataRtl interfaces, Heap ManagerRtlCloneUserProcess function, Process ReflectionRtlCreateProcessReflection function, Process ReflectionRtlGenerate8dot3Name function, File NamesRun DLL Component (Rundll32.exe), Driver Installation, Logical Prefetcherrun-time environments, User-Mode Driver Framework (UMDF), User-Mode Driver Framework (UMDF)runs, Master File Table, Master File Table, Resident and Nonresident Attributes, Resident and Nonresident Attributes, Resident and Nonresident Attributes, Compressing Sparse Data, Compressing Sparse Data, Compressing Nonsparse DataRW (Read-Write) handles, LockingRWH handles, Locking