Windows ConfidentialThe File System Paradox

Raymond Chen

If you take a look around your hard drive, you probably have noticed that a good number of operating system files hang out in the root directory of the boot drive. If you take a closer look at those files, you may notice a theme: boot.ini, NTLDR, and NTDETECT.COM are critical boot files, and hiberfil.sys is the hibernation file. These are all files that are involved in the crucial first stages of booting the operating system or, in the case of hiberfil.sys, resuming from hibernation, and they have to go into the root of the boot drive. Why can't you move them somewhere else?

My colleague Adrian Oney explained: in order to read the boot files off the disk, you need the file system driver, but the file system driver is on the disk, which you can't read until you've loaded the file system driver. Oh no, Catch-22!

The vicious cycle is broken by having a miniature file system driver built into the critical boot files. This miniature driver knows just barely enough to locate files in the root directory and load them into memory. Those files can, in turn, get the operating system off the ground, at which point the real file system driver can take over and look for files in much fancier places like subdirectories.

Hibernation follows a similar pattern. Hibernating the operating system means dumping the entire contents of memory into the hibernation file; restoring from hibernation entails sucking that file back into memory and pretending nothing happened. Again, it's another chicken-and-egg problem: to load the hibernation file, you need the file system driver, but the file system driver is in the hibernation file. If you keep the hibernation file in the root directory of the boot drive, the miniature file system driver can be used instead.

Those who have used early versions of MS-DOS® are well aware of this constraint on the location of the operating system boot files. The old SYS command made a boring old floppy disk into a magic bootable floppy disk. However, if you ran it on a floppy disk that already had data on it, there was a good chance the conversion would fail because early versions of MS-DOS required that the boot files occupy specific locations on the floppy disk in order for the boot sector to find them. Later versions of MS-DOS relaxed these requirements by making improvements to the boot loader, but even with the improved version, the system files still must reside in the root directory.

One customer asked, "Can I move the hibernation file into a subdirectory?" After all, why does it matter where the file is? The ACLs on the file would be the same regardless of where you put it. But these folks wanted to put it on a drive different from the boot drive and had been told that can't be done. They didn't really understand the reason for this restriction, so they tried an end run: well, if I can at least move it into a subdirectory, then I can create a directory and make that a junction that points to where I really want the hiberation file. Woo hoo—I relocated the hibernation file!

Of course, the miniature file system driver doesn't understand mount points, because mount points mean talking to the disk management service, and at the time the system is booting, the computer hasn't even loaded the operating system yet, much less some fancy advanced service that knows how to map drive letters back to ARC paths, and even if you somehow got that service running, you still have to find the device drivers for those other hard drives and load the corresponding file system drivers.

It's only a matter of time before somebody asks for a way to put the hibernation file on a DFS junction.

Raymond Chen's Web site, The Old New Thing, and identically titled book (Addison-Wesley, 2007) deal with Windows history and Win32 programming. His Web 2.0 name is Raymond, or maybe Chenster.

© 2008 Microsoft Corporation and CMP Media, LLC. All rights reserved; reproduction in part or in whole without permission is prohibited.