Detailed Explanation of Windows Boot Process on UEFI and Legacy BIOS

The Windows boot process differs significantly depending on the firmware environment (UEFI or Legacy BIOS). Additionally, special boot technologies like WIMBoot, VHD, and RAMDisk are available for specific application scenarios. Each boot method has its own advantages and disadvantages, making them suitable for different hardware configurations and user needs. UEFI, as the mainstream boot method for modern computers, offers faster boot speeds, larger disk capacity support, and a more secure boot mechanism compared to traditional Legacy BIOS, while WIMBoot, VHD, and RAMDisk provide flexible system deployment solutions for specific scenarios.

I. UEFI Boot Process

The UEFI boot process is the mainstream boot method for modern Windows systems. Its core advantage lies in simplifying the boot steps and improving boot efficiency. In a UEFI environment, the Windows boot process mainly consists of the following key stages:

First, when the computer powers on, the firmware performs Power-On Self-Test (POST). However, unlike Legacy BIOS, the UEFI POST process is more streamlined and efficient. UEFI firmware runs in 32-bit or 64-bit mode, breaking through the 16-bit code addressing limitations of Legacy BIOS, allowing it to handle hardware resources more flexibly. After firmware initialization, it directly loads and executes the boot manager (e.g., bootmgfw.efi) located in the EFI partition, bypassing the traditional MBR and PBR stages.

Once the boot manager (bootmgfw.efi) is loaded, it reads the Boot Configuration Data (BCD) file located in the EFI partition. This file determines the system boot menu and boot order. In the BCD file, multiple boot entries can be configured, including regular Windows systems, systems in VHD files, or WIMBoot images. The boot manager displays the boot menu based on the BCD configuration. After the user makes a selection, the boot manager loads the corresponding boot loader (e.g., winload.efi).

The boot loader (winload.efi) is responsible for loading the Windows kernel and necessary drivers, ultimately handing control over to the operating system. In a UEFI environment, Windows can directly utilize the driver interfaces provided by UEFI, eliminating the need to rely on traditional 16-bit real-mode drivers.

The streamlined UEFI boot process significantly improves boot speed, especially when using high-speed storage devices like SSDs. UEFI also supports the Secure Boot feature, which prevents malicious software from running during the boot phase, enhancing system security. Furthermore, UEFI supports the GPT partition table, enabling it to handle hard drives larger than 2TB, breaking the MBR partition limit of Legacy BIOS.

II. Legacy BIOS Boot Process

Legacy BIOS is the traditional boot method for computers. Although modern computers have widely adopted UEFI, it may still be used on older devices or in specific scenarios. The Legacy BIOS boot process is more complex and mainly includes the following stages:

When the computer powers on, the BIOS first performs POST, which checks basic hardware configurations and initializes critical hardware. Unlike UEFI, the Legacy BIOS POST process is more lengthy, as it checks and initializes hardware one by one. After POST completes, the BIOS looks for the Master Boot Record (MBR) on the hard drive. The MBR is located in the first 512 bytes of the hard drive and contains the hard drive partition table information and partition boot code.

The partition boot code in the MBR reads the Disk Partition Table (DPT) and finds the active primary partition based on the active partition flag. Then, the MBR hands control over to the Partition Boot Record (PBR) of that active partition. The PBR is the boot code located in the first sector of each partition, responsible for initializing the partition and loading the boot manager (e.g., bootmgr) from the root directory of the partition.

Once the boot manager (bootmgr) is loaded, it reads the BCD file located in the boot folder of the active partition. The BCD file determines the system boot menu and boot order and can configure multiple operating systems or boot entries. The boot manager displays the boot menu based on the BCD configuration. After the user makes a selection, the boot manager loads the corresponding operating system kernel (e.g., winload.exe).

The kernel loader (winload.exe) is responsible for loading the Windows kernel and necessary drivers, ultimately handing control over to the operating system. In a Legacy BIOS environment, Windows needs to initialize hardware through traditional 16-bit real-mode drivers, which are typically located in the system’s boot.ini file.

The main limitations of Legacy BIOS are that it only supports the MBR partition table, with a maximum hard drive size of 2TB and a maximum of 4 primary partitions. Additionally, Legacy BIOS has slower boot speeds, does not support modern security features like Secure Boot, and cannot directly utilize the advanced features provided by UEFI.

III. Detailed Explanation of Special Boot Technologies

In addition to the standard UEFI and Legacy BIOS boot methods, Windows offers several special boot technologies for specific scenarios and needs:

1. WIMBoot Boot Technology

WIMBoot is a boot technology introduced in Windows 8.1 and later versions. Its core principle is to boot the system directly from a compressed Windows Imaging (WIM) file without fully extracting the system files to the physical hard drive. WIMBoot technology can compress the Windows system to approximately 4GB, saving about 60-70% of disk space compared to traditional installation, making it particularly suitable for small-capacity storage devices.

The WIMBoot boot process is as follows:

• When the computer starts, the UEFI firmware loads the boot manager (bootmgfw.efi) from the EFI partition.
• The boot manager reads the BCD configuration file and identifies the WIMBoot boot entry.
• The system reads system files from the WIM partition through pointer files and dynamically decompresses them into memory.
• The Windows kernel and necessary drivers are loaded, completing the system boot.

The key to WIMBoot technology is the file system filter driver (WoF.sys), which manages the reading and decompression of WIM files. When the system needs to read a file, WoF.sys dynamically decompresses that file from the WIM file into memory. When the system needs to write a file, the new file is written to the pointer partition instead of modifying the original WIM file.

Configuration requirements for WIMBoot include:

• Must use a UEFI firmware environment.
• The storage device must be an SSD; traditional mechanical hard drives are not supported.
• Applicable to Windows 8.1, Windows 10, and later versions.

Considerations when using WIMBoot:

• System updates may lead to increased disk space usage.
• Does not support disk encryption features like BitLocker.
• Regular backups of the WIM partition and pointer partition are required to ensure system recovery capability.
• Some system backup tools and antivirus software may be incompatible with WIMBoot.

2. VHD Native Boot Technology

VHD (Virtual Hard Disk) native boot technology allows a Windows system to boot directly from a virtual hard disk file without relying on virtual machine software. VHD boot technology provides a flexible system deployment solution, supporting the deployment of multiple operating system environments on the same physical device, facilitating system testing, recovery, and migration.

The VHD boot process is as follows:

• When the computer starts, the UEFI firmware loads the boot manager (bootmgfw.efi) from the EFI partition.
• The boot manager reads the BCD configuration file and identifies the VHD boot entry.
• The system loads the VHD file as a virtual disk device.
• The Windows kernel and necessary drivers are loaded from the VHD file.
• The system boot completes, and the VHD file is mounted as the system partition.

The key to VHD boot technology lies in the special parameters in the BCD configuration file. The bcdedit command must be used to add a path pointing to the VHD file. For example, adding a boot entry from a VHD requires executing the following commands:

bcdedit /copy {current} /d "Windows from VHD"
bcdedit /set {newly created identifier} osdevice vhd=[C:]\Windows.vhd
bcdedit /set {newly created identifier} device vhd=[C:]\Windows.vhd

Configuration requirements for VHD boot include:

• Must use a UEFI firmware environment.
• The VHD file must be stored on an NTFS-formatted physical partition.
• The VHDx format is recommended.
• Applicable to Windows 7 Enterprise/Ultimate, Windows 8/10, and later versions.

Considerations when using VHD boot:

• VHD boot does not support system hibernation.
• The VHD file cannot be stored on an encrypted or compressed partition.
• VHD files cannot be nested (i.e., you cannot use a VHD within another VHD).
• VHD boot does not support BitLocker encryption.
• The maximum number of attached VHD files is approximately 512.
• Server Message Block (SMB) sharing cannot be used on VHD files.
• Dynamic disk configurations and software RAID do not support VHD boot.

3. RAMDisk Boot Technology

RAMDisk is a technology that virtualizes system memory as a disk, which can be used to accelerate system performance. Although Microsoft does not officially support booting a regular Windows system from a RAMDisk, RAMDisk technology is widely used in Windows PE environments for fast booting and system maintenance.

The RAMDisk boot process (using Windows PE as an example):

• When the computer starts, the UEFI firmware loads the boot manager (bootmgfw.efi) from the EFI partition.
• The boot manager reads the BCD configuration file and identifies the RAMDisk boot entry.
• The system creates a virtual disk (RAMDisk) in memory.
• System files are decompressed from the WIM file to the RAMDisk virtual disk.
• The Windows PE kernel and necessary drivers are loaded from the RAMDisk.
• The system boot completes, providing a temporary environment.

The key to RAMDisk technology is partitioning memory into virtual disk space and managing memory access through a file system driver (e.g., ramdisk.sys). In a Windows PE environment, system files are temporarily decompressed into memory, providing a fast boot and runtime environment.

Configuration requirements for RAMDisk include:

• Sufficient physical memory is required (it is recommended to reserve at least 4GB of memory for the system).
• Applicable to Windows PE environments; regular Windows systems do not support booting directly from a RAMDisk.
• Can be used for temporary file acceleration (e.g., pointing the system’s TEMP and TMP folders to the RAMDisk).

Considerations when using RAMDisk:

• Data in the RAMDisk is lost when power is lost; important data must be saved to physical storage devices in a timely manner.
• Allocating too much memory space to the RAMDisk may cause system instability.
• The performance improvement from RAMDisk is mainly reflected in temporary file read and write operations, with limited impact on core system performance.
• The RAMDisk size and cache granularity should be set reasonably based on memory capacity.
• Suitable for scenarios requiring a fast boot of a temporary environment (e.g., system maintenance or game acceleration).

The following table provides a comprehensive comparison of the four boot methods: regular Windows installation, WIMBoot, VHD, and RAMDisk:

Boot Method	Partition Requirement	System Support	Boot Speed	Storage Space Usage	Security Features	Main Advantages	Main Limitations
Regular Installation (UEFI)	GPT Partition	Windows 8/10/11 64-bit	Fast (reduced POST steps)	~15-20GB	Supports Secure Boot	Fast boot speed, supports large capacity hard drives	Requires UEFI environment
Regular Installation (Legacy BIOS)	MBR Partition	Windows 7 and earlier	Slower (requires full POST)	~15-20GB	Does not support Secure Boot	Good compatibility, supports older systems	Does not support >2TB hard drives, max 4 primary partitions
WIMBoot	GPT Partition	Windows 8.1/10/11	Medium	~4-6GB	Supports Secure Boot	Saves space, fast deployment	Requires UEFI, only supports SSD, does not support BitLocker
VHD Boot	GPT Partition	Windows 7 Enterprise/Ultimate, Win8/10+	Medium	~15-20GB (VHD file)	Supports Secure Boot	Multi-system support, easy migration	Does not support hibernation, files cannot be nested
RAMDisk Boot (WinPE)	Any	Windows PE environment only	Extremely Fast	Nearly zero (in memory)	Not supported	Memory speed, clean system	Data lost on power loss, requires sufficient memory

Regular Installation (UEFI) vs. Regular Installation (Legacy BIOS): The UEFI boot method has significant advantages over Legacy BIOS, including faster boot speeds, larger disk capacity support, and a more secure boot mechanism. However, Legacy BIOS still holds value on older devices or when installing older Windows systems.

WIMBoot Technology: WIMBoot is particularly suitable for small-capacity storage devices, significantly reducing system space usage through compression technology. However, it does not support traditional mechanical hard drives or BitLocker encryption, and system updates may lead to increased space usage.

VHD Boot Technology: VHD boot provides a flexible multi-system management solution, facilitating system testing and recovery. However, it does not support hibernation and has strict restrictions on the storage location and format of VHD files.

RAMDisk Boot (WinPE): RAMDisk provides extremely fast boot speeds in Windows PE environments but cannot directly boot a regular Windows system, and data is lost when power is lost.

V. Implementation Principles of Various Boot Methods

1. Implementation Principle of Regular Installation

Regular Windows installation is the most basic boot method. Its core is writing system files directly to a physical hard drive partition. In a UEFI environment, the system installation creates the following key partitions:

• System Partition (ESP/EFI Partition): Stores the EFI files and BCD configuration files required for booting.
• Windows Partition: Stores the operating system files and applications.

In a Legacy BIOS environment, the system installation creates a traditional MBR partition table and places the boot manager (bootmgr) in the root directory of the partition, storing the BCD configuration file in the boot folder of the active partition.

The boot process of a regular installation depends on the read/write performance of the physical hard drive. Boot speed is limited by the type and performance of the hard drive. SSD hard drives offer faster boot speeds compared to traditional mechanical hard drives, but they are still not as fast as special boot technologies like WIMBoot or RAMDisk.

2. Implementation Principle of WIMBoot

The core of WIMBoot technology is using a file system filter driver (WoF.sys) to read system files directly from a compressed WIM file without fully extracting them to the physical hard drive. A WIMBoot system consists of two key partitions: the partition storing the WIM file and the partition storing pointer files. Pointer files are small files that point to the corresponding files in the WIM file.

When the system needs to read a file, WoF.sys dynamically decompresses that file from the WIM file into memory. When the system needs to write a file, the new file is written to the pointer partition instead of modifying the original WIM file. This mechanism allows the system to maintain the integrity of the WIM file while allowing users to perform system updates and file modifications.

The implementation principle of WIMBoot also includes:

• Generating pointer files and configuring BCD boot entries.
• Loading the WoF.sys driver in a UEFI environment to manage the file system.
• System updates and patches are written directly to the pointer partition, not decompressed to the physical partition.

This technology is particularly suitable for small-capacity storage devices, freeing up more space for user data and application storage.

3. Implementation Principle of VHD Boot

VHD boot technology allows an operating system to boot directly from a virtual hard disk file, which can be in fixed-size or dynamically expanding VHD/VHDx format. The core of VHD boot is the special parameters in the BCD configuration file that point to the VHD file as the system partition.

During the boot process, the Windows boot loader loads the VHD file as a virtual disk device and mounts it as the system partition. The system file structure within the VHD file is the same as that of a physical hard drive partition, including necessary boot files and system files.

The implementation principle of VHD boot also includes:

• Writing the system image to the VHD file.
• Creating a BCD store and configuring the VHD boot entry.
• Loading the VHD driver and mounting the virtual disk during the boot phase.
• During system runtime, the VHD file is treated as a physical disk, supporting normal read and write operations.

This technology is particularly suitable for scenarios where multiple operating system environments need to be deployed on the same physical device, such as development testing or system recovery.

4. Implementation Principle of RAMDisk Boot

The core of RAMDisk boot technology (mainly used in Windows PE environments) is partitioning system memory into virtual disk space and managing memory access through a file system driver. The advantage of RAMDisk boot is that memory read/write speeds are much higher than physical hard drives, significantly improving boot speed and system responsiveness.

In a Windows PE environment, system files are temporarily decompressed to the RAMDisk virtual disk, and then the system kernel and drivers are loaded from this virtual disk. This mechanism allows Windows PE to boot in an extremely short time, providing a lightweight system maintenance environment.

The implementation principle of RAMDisk boot also includes:

• Decompressing the system image into memory.
• Creating a virtual disk driver (ramdisk.sys) to manage memory access.
• Dynamically allocating memory space as a virtual disk during the boot process.
• During system runtime, all file operations are performed directly in memory.

This technology is particularly suitable for scenarios requiring a fast boot of a temporary environment, such as system maintenance or game acceleration.

VI. Configuration and Implementation Guide

1. Configuration Steps for UEFI Boot

To configure UEFI boot, you must first ensure that the motherboard supports UEFI firmware and enable UEFI mode in the BIOS settings. The specific steps are as follows.

Create the necessary UEFI partitions, including the System Partition (ESP partition, typically requiring 100-200MB of space) and the Windows Partition (for storing system files).

Finally, use the bcdboot command or bootcie.exe to create the BCD configuration file and configure the boot entries. For example:

bcdboot C:\Windows /s S: /f UEFI

Here, C: is the Windows system partition, S: is the System Partition (ESP partition), and /f UEFI specifies creating the boot files using the UEFI format.

2. Configuration Steps for WIMBoot

To configure WIMBoot boot, the specific steps are as follows:

Generate the WIM pointer files and configure the BCD boot entry:

Dism /Apply-Image /ImageFile:D:\wimboot.wim /ApplyDir:E:\ /Index:1 /WIMBoot
bcdboot E:\Windows /s S: /f UEFI

Here, E: is the partition storing the pointer files, and S: is the System Partition (ESP partition).

Finally, select the WIMBoot boot entry in the boot menu, and the system will boot directly from the WIM file.

3. Configuration Steps for VHD Boot

To configure VHD boot, you need to first create a VHD file and install the system into it. The specific steps are as follows:

First, use the Disk Management tool to create a VHD file.

Then, install the Windows system into the VHD file:

bcdboot C:\Windows /s S: /f UEFI
bcdedit /copy {current} /d "Windows from VHD"
bcdedit /set {newly created identifier} osdevice vhd=[C:]\Windows.vhd
bcdedit /set {newly created identifier} device vhd=[C:]\Windows.vhd

Finally, select the VHD boot entry in the boot menu, and the system will boot from the VHD file.

Using WinNTSetup to install a VHD system is more convenient. Please refer to my article “22 Installing VHD System“ for details.

VII. Practical Application Scenarios and Selection Recommendations

Different boot methods are suitable for different scenarios. Choosing the appropriate boot method requires considering hardware conditions, system requirements, and performance expectations.

Regular Installation (UEFI): Suitable for most modern computers, especially those using high-speed storage devices like SSDs. UEFI boot provides the best boot speed and system performance while supporting security features like Secure Boot. Recommended as the preferred boot method for new computers, especially for scenarios requiring fast boot and large storage capacity.

Regular Installation (Legacy BIOS): Suitable for older computers or scenarios requiring the installation of older Windows systems (e.g., Windows 7 32-bit). Although Legacy BIOS boot is slower, it offers better compatibility and can be used on devices that do not support UEFI.

WIMBoot: Particularly suitable for small-capacity storage devices (e.g., tablets or ultrabooks with 16GB or 32GB of storage). WIMBoot can compress the Windows system to approximately 4GB, freeing up more space for user data and application storage. Recommended for scenarios requiring maximum storage space utilization, such as mobile devices or low-configuration computers.

VHD Boot: Suitable for scenarios requiring the deployment of multiple operating system environments on the same physical device, such as development testing, system recovery, or multi-environment work. VHD boot provides a flexible system management solution, facilitating system migration and backup. Recommended for scenarios requiring system isolation or rapid deployment, such as enterprise IT departments or software developers.

RAMDisk Boot (WinPE): Suitable for scenarios involving system maintenance, fault repair, or temporary performance optimization. RAMDisk boot provides extremely fast boot speeds and system responsiveness, but data is lost when power is lost. Recommended for scenarios requiring a fast boot of a temporary environment, such as system maintenance or game acceleration.

When selecting a boot method, consider the following factors:

• Hardware Compatibility: Ensure the chosen boot method is compatible with the motherboard firmware and storage device.
• System Requirements: Choose the appropriate boot method based on required features (e.g., hibernation, BitLocker).
• Storage Space: For small-capacity storage devices, WIMBoot may be a better choice.
• Performance Expectations: For scenarios requiring fast boot, UEFI or RAMDisk may be better choices.
• Maintenance Needs: For scenarios requiring system isolation or multi-environment work, VHD boot may be a better choice.

VIII. Future Development Trends and Technology Outlook

With the development of computer hardware and software technologies, the boot methods of Windows systems are also evolving. Future Windows systems may further optimize the UEFI boot process to improve boot speed and security. At the same time, special boot technologies like WIMBoot, VHD, and RAMDisk may also receive more feature support and performance optimization.

Future developments in UEFI technology may include:

• More efficient boot processes and more powerful hardware management capabilities.
• Broader support for Secure Boot and more flexible certificate management.
• Better compatibility and richer feature support, such as network booting and remote management.

Future developments in WIMBoot technology may include:

• More efficient compression algorithms and more flexible file management systems.
• Broader feature support, such as compatibility with encryption features like BitLocker.
• Better performance optimization to reduce the increase in space usage caused by system updates.

Future developments in VHD technology may include:

• Broader feature support, such as compatibility with hibernation and sleep features.
• More efficient virtual disk management and more stable performance.
• More flexible deployment solutions, such as supporting new storage methods like network storage and cloud storage.

Future developments in RAMDisk technology may include:

• Broader feature support, such as supporting booting a regular Windows system from a RAMDisk.
• More efficient memory management algorithms and more stable performance.
• More flexible deployment solutions, such as supporting hybrid use with physical storage devices.

With the development of these technologies, the boot methods of Windows systems will become more flexible, efficient, and secure, providing users with a better experience.

IX. Common Problems and Solutions

When using different boot methods, various problems may be encountered. The following are common problems and their solutions:

1. UEFI Boot Failure

Common causes of UEFI boot failure include:

• The System Partition (ESP partition) is not correctly created or configured.
• Necessary UEFI drivers are missing.

Solutions:

• Ensure the System Partition (ESP partition) is correctly created and allocated at least 100MB of space.
• Check the Secure Boot settings; disable it or update certificates if necessary.

2. Insufficient Space in WIMBoot System

Common causes of insufficient space in a WIMBoot system include:

• System updates cause increased space usage in the pointer partition.
• The user has installed a large number of applications and data.
• The WIM file is corrupted or decompression fails.

Solutions:

• Regularly clean up system update caches and temporary files.
• Install user data and applications on a non-pointer partition.
• Use the Dism tool to recreate the WIMBoot image.

3. VHD Boot Performance Issues

Common causes of VHD boot performance issues include:

• The VHD file is stored on a slow physical partition.
• The VHD file format is unsuitable (e.g., using dynamic expansion instead of fixed size).
• Frequent system write operations cause performance degradation.

Solutions:

• Store the VHD file on a high-speed storage device like an SSD.
• Use a fixed-size VHD/VHDx file format.
• Optimize system settings to reduce frequent write operations.

By understanding these common problems and solutions, you can better manage and maintain Windows systems using different boot methods, ensuring system stability and performance.

X. Summary and Recommendations

Windows systems offer a variety of boot methods, each with its own characteristics and applicable scenarios. UEFI, as the mainstream boot method for modern computers, provides the best boot speed and system performance while supporting security features like Secure Boot. Regular installation is the most basic boot method, suitable for most modern computers. WIMBoot is particularly suitable for small-capacity storage devices. VHD boot provides a flexible multi-system management solution. RAMDisk boot (mainly used in Windows PE environments) offers extremely fast boot speeds and system responsiveness.

When choosing a boot method, make a reasonable decision based on specific needs and hardware conditions. For new computers, it is recommended to use the UEFI+GPT partition format to install Windows 10/11. For small-capacity storage devices, consider WIMBoot technology. For scenarios requiring multi-system management, VHD boot provides a flexible solution. For system maintenance or temporary environment needs, the RAMDisk boot technology in Windows PE can provide fast responsiveness.

Regardless of the boot method chosen, ensure the system configuration is correct, back up important data regularly, and pay attention to system updates and driver compatibility. With the development of technology, the boot methods of Windows systems will become more flexible, efficient, and secure, providing users with a better experience.