How Windows XP Logged Driver Loads to NTBTLOG.TXT

In Windows XP, boot logging provided a diagnostic trail of hardware and system initialization by appending driver load events to a plain text file named ntbtlog.txt located in the %SystemRoot% directory. When enabled via the startup menu or system configuration files, the operating system's kernel tracked the invocation and status of every critical boot, system, and autoload driver. This article explains the technical mechanics of how Windows XP captured and committed these successful driver load entries to disk during the boot process.

Boot logging was engaged before the Windows kernel even executed. Users triggered the feature either by selecting "Enable Boot Logging" from the Windows Advanced Options menu (accessed by pressing F8 during POST) or by adding the /bootlog parameter to the target operating system entry in the boot.ini configuration file. When selected, the boot loader (NTLDR) parsed the /bootlog switch and set an internal configuration flag within the loader parameter block (LOADER_PARAMETER_BLOCK), passing this directive to the Windows kernel executable (NTOSKRNL.EXE).

During Phase 0 of the kernel initialization sequence, file system drivers were not yet available to write logs directly to the disk. To prevent losing records of the earliest low-level drivers, the kernel’s I/O Manager maintained an internal memory buffer. As the kernel processed early drivers required to access storage and core system services, it cached each driver's binary path and initialization result.

Once Phase 1 initialization commenced, the boot storage device stack and file system driver (NTFS or FAT32) became operational, allowing standard file I/O operations. The kernel created or opened %SystemRoot%\ntbtlog.txt in append mode. It first flushed any previously buffered startup records into the file and then transitioned to direct logging for all subsequent drivers.

The actual detection of a "success" message depended on the return code of a driver’s entry point function (DriverEntry). When the kernel's I/O Subsystem invoked a driver via routines such as IopInitializeBuiltinDriver or NtLoadDriver, the driver performed its setup routine and returned an NTSTATUS code. If the routine returned STATUS_SUCCESS, the I/O Manager verified that the driver was operational.

Upon receiving STATUS_SUCCESS, the kernel formatted an entry string:

Loaded driver \SystemRoot\system32\DRIVERS\<driver_name>.sys

This entry explicitly confirmed that the driver binary was found on the storage volume, passed integrity and dependency checks, mapped into system memory, and initialized without unhandled errors.

As the operating system completed the boot sequence, control passed to the Service Control Manager (SERVICES.EXE), which loaded drivers and services set to Automatic start. As each service driver successfully initialized, the system continued appending the formatted confirmation lines directly to ntbtlog.txt until the logon interface appeared, giving technicians a complete record of loaded components.