Marathwada Shikshan Prasarak Mandal’s

Deogiri Institute of Engineering and Management Studies,

Aurangabad

Survey Report

On

Windows 2000

Submitted By

Sadiya Fatima Khwaja (26129)

Dr. Babasaheb Ambedkar Techological University

Lonere, Raigad (M.S.)

Department of Computer Science and Engineering (TNR-16)

Deogiri Institute of Engineering and Management Studies,
Aurangabad
(2022- 2023)
 CERTIFICATE

This is to certify that, the Operating System entitled “Windows 2000” submitted by
Sadiya Fatima Khwaja is a bonafide work completed under mysupervision and guidance.

Place: Aurangabad
Date: 19/06/2023

Mr. Vijay S. Kolte

Guide
 Abstract
Windows 2000 is an operating system (OS) developed by Microsoft. Released in February
2000, it was designed to run application programs, store files, support networking and run
multimedia features. Extended support for Windows 2000 was discontinued in 2010.
Windows 2000 was a direct successor to Windows NT 4.0 and was followed by Windows
XP. This version of Windows OS offered better and more stable support for computer
hardware than prior Microsoft OSes. Previously called Windows NT 5.0, Microsoft
emphasized that Windows 2000 was evolutionary and built on NT technology, which was a
combination of Windows NT Workstation and Windows NT Server. Windows 2000 was
designed to appeal to small and medium-sized businesses (SMBs) and professional users, as
well as to the more technical and larger business market for which NT was designed.
Windows 2000 was reported to be more stable than Windows 98 and NT systems, as it was
designed to be less apt to crash. A significant new feature was Microsoft's Active Directory
services; among other capabilities, it enabled an organization to set up virtual private
networks, encrypt data locally or on the network, and give users access to shared files in a
consistent way from any network computer. Additional new features in this update included
Active Desktop, Universal Serial Bus, NT File System 3.0 and File Allocation Table 32.
Microsoft Installer provided a uniform experience for installing and uninstalling programs.
The Microsoft Management Console aided in managing vital system functions, and a
Recovery Console helped resolve software failures. Also included in the OS was an
Encrypting File System, which offered accessibility and networking features.
 Contents

1. Introduction of OS 1

2. Resource Management 3

3. Process Management 6

4. Memory Management 10

5. Storage Management 13

6. Conclusion

REFERENCES
 1. Introduction

Windows 2000, originally named NT 5.0, is a continuation of the Microsoft Windows

NT family of operating systems, replacing Windows NT 4.0. Chairman and CEO Bill
Gates was originally "pretty confident" NT 5.0 would ship in the first half of
1998, revealing that the first set of beta builds had been shipped in early 1997; these
builds were identical to Windows NT 4.0. The first official beta was released in
September 1997, followed by Beta 2 in August 1998. The minimum requirement for
installation is a Pentium processor, 32MB main memory, 650 MB of free hard disk
storage are needed. Microsoft had planned to develop an operating system version for the
Alpha architecture. The plans were stopped after an announcement of Compaq. The field
of application of this operating system is suitable as a single-user computer or as a client
in company networks. Windows 2000 authenticates the user first at the access to files,
printers or other computers. Networks are supported with the protocol TCP/IP, NWLink,
and AppleTalk. It supports the data interchange in decentralized working groups and
central domains. The hierarchical database saves information about the hardware and
applications as well as configuration settings. The system file protection offers protection
from overwriting of Windows system files. It is possible to create hardware profiles for
different hardware configuration with the setting of all the devices and services.Windows
2000 professional is also suitable for mobile users like a notebook computer. An assistant
supports the user at the administration of the network connections with the use of VPN
(Virtual Private Network), and IPSec (Internet Protocol Security) secure mobile access to
company networks is possible. NTFS is used as the file system in the new version 5. The
blueprint of customer rights is applicable for documents and directories on file system
method, file compression in real time, disk storage allocation, and encrypted with EFS
(Encrypting file system) can also be used. At the requirement of rights, the Access
Control List (ACL) is saved with each file and each directory. The compression and
encoding ignore each other, only one of the options on the equal object can be used. The
Windows 2000 operating system architecture is a hybrid architecture that is comprised of
client/server, layered, object-oriented, and symmetric multiprocessing architecture
principles. Although it uses objects to represent shared system resources, Windows 2000
is not strictly an object-oriented operating system. The bulk of the code is written in C for
both tool availability and portability, and C does not directly support object-oriented
constructs. Windows 2000 borrows from the features of object-oriented languages. Its

1
features include 32-bit addressing, virtual memory support, system security and enhanced
system integrity, platform independence, and built-in modular networking. The operating
system is built upon a layered approach, similar to the UNIX operating system. One
advantage of the layered operating structure is that each layer of code is given access only
to the layer below it (interfaces and data structures). This structure also allows the
operating system to be debugged, starting at the lowest layer and adding one layer at a
time until the whole system works correctly. Layering also makes it easier to enhance the
operating system; one entire layer can be replaced without affecting other parts of the
operating system. Windows 2000 is a portable operating system because of two design
decisions. First, the operating system was written in ANSI C, a language that enables
programs to be ported easily to other hardware architectures. Second, all parts of
Windows 2000 that must be written for a specific hardware are isolated in an area called
the Hardware Abstraction Layer (HAL). To move Windows 2000 to a new hardware
platform, developers need to do little more than recompile the C code for the new
hardware and create a new HAL. Designing an OS around a HAL means that a large
portion of the code is the same between hardware platforms. This also means that only the
small slice of code that interfaces with the computer's hardware needs to be rewritten as
Windows 2000 is ported between different processor architectures. Windows 2000 is a
highly modular system that consists of two main layers: a user mode and a kernel mode.
The user mode refers to the mode in which user programs are run. Such programs are
limited in terms of what system resources they have access to, while the kernel mode has
unrestricted access to the system memory and external devices. All user mode
applications access system resources through the executive which runs in kernel mode.
Windows 2000 has support for many languages other than English. It supports Arabic,
Armenian, Baltic, Central European, Cyrillic, Georgian, Greek, Hebrew, Indic, Japanese,
Korean, Simplified Chinese, Thai, Traditional Chinese, Turkic, Vietnamese, and Western
European languages. It also has support for many different locales, a list of which can be
found on Microsoft's website.

2
 2. Resource Management

In computer programming, resource management refers to techniques for managing

resources (components with limited availability). It includes both preventing resource
leaks (releasing a resource when a process has finished using it) and dealing with resource
contention (when multiple processes wish to access a limited resource). Resource leaks
are an issue in sequential computing, while resource contention is an issue in concurrent
computing. On many systems the operating system reclaims resources after the process
makes the exit system call.

Windows 2000, released by Microsoft in February 2000, introduced several resource

management features to optimize system performance. Here are some key aspects of
resource management in Windows 2000.

CPU Scheduling: Windows 2000 implemented preemptive multitasking, allowing the

operating system to efficiently allocate CPU time to different processes. The Task
Manager utility provided visibility into CPU usage and allowed users to manage
processes.

Memory Management: Windows 2000 introduced a more advanced memory management

system compared to its predecessors. It supported virtual memory, which enabled
processes to use more memory than physically available. The operating system used a
paging system to swap data between physical memory and the hard disk.

Disk Management: Windows 2000 included the Disk Defragmenter utility to rearrange
files on the hard disk, optimizing data access and improving disk performance.
Additionally, it introduced the Disk Management MMC snap-in, allowing users to create
and manage disk partitions.

I/O Management: Windows 2000 implemented the I/O Manager, a component

responsible for handling input/output operations. It provided a unified interface for device
drivers and managed I/O requests efficiently, improving system responsiveness.

Network Management: Windows 2000 included features for network resource

management, such as the ability to prioritize network traffic based on Quality of Service
(QoS) settings. It supported network protocols like TCP/IP, NetBIOS, and IPX/SPX.

3
Power Management: Windows 2000 introduced advanced power management features,
allowing the operating system to optimize power usage on laptops and desktops. It
included options for standby, hibernate, and power profiles to balance performance and
power consumption.

System Monitor: Windows 2000 provided the System Monitor utility, which allowed
administrators to monitor system resources in real-time. It enabled tracking of CPU usage,
memory utilization, disk activity, network traffic, and more.

The goal of the Windows 2000 I/O system is to provide a framework for efficiently
handle various I/O devices. These includes keyboards, mice, touch pads, joysticks,
scanners, still cameras, television cameras, bar code readers, microphones, monitors,
printers, plotters, beamers, CD-records, sound cards, clocks, networks, telephones,
and camcorders.
The I/O manager works in conjunction with the plug-and-play manager and closely
connected with the plug and play manager. The power manager can put the computer
into six different states: (1) fully operational, (2) Sleep-1: CPU power reduced, RAM
and cache on; instant wake up, (3) Sleep-2: CPU and RAM on; CPU cache off;
continue from current PC; (4) Sleep-3: CPU and cache off; RAM on; restart from
fixed address; (5) Hibernate: CPU, cache, and RAM off; restart from saved disk file;
(6) off: Everything off; full reboot required. Similarly I/O devices can be in various
power states using power manager. It is pertinent to note that all the file systems are
technically I/O drivers and request for any data block is initially sent to the cache
manager and on failure it is directed to the I/O manager, which calls the proper file
system driver to get the required block from the disk.
Windows 2000 supports dynamic disk, which spans multiple partitions and even
multiple disks and may be reconfigured on fly without rebooting the system.
Windows 2000 also provide support for asynchronous I/O and it is possible for a
thread to start an I/O operation and then continue executing in parallel with the I/O.
This feature is very important on servers.
Implementation of I/O
I/O manager creates a framework where different I/O devices can operate. This
framework consists of a set of device-independent procedures for certain aspects of
I/O plus a set of loaded device drivers for communicating with the devices.
In Windows 2000,

4
at boot time, or when a new hot pluggable plug-and-play device is attached to the
computer, the system detects it and calls the plug-and-play manager. The plug-and play
manager detects the manufacturer and model number from the device. After that
it looks for the corresponding driver in the hard disk or prompts the user to insert a
floppy disk or CD-ROM with driver. Once detected the driver is loaded into the
memory.

5
 3. Process Management

Each process in Windows 2000 operating system contains its own independent virtual
address space with both code and data, protected from other processes. Each process,
in turn, contains one or more independently executing threads. A thread running
within a process can create new threads, create new independent processes, and
manage communication and synchronization between the objects.
By creating and managing processes, applications can have multiple, concurrent tasks
processing files, performing computations, or communicating with other networked
systems. It is even possible to exploit multiple processors to speed processing.
The following sections explain the basics of process management and also
introduce the basic synchronization operations.
Windows Processes and Threads
Every process consists of one or more threads, and the Windows thread is the basic
executable unit. Threads are scheduled on the basis of the following factors: (a)
availability of resources such as CPUs and physical memory, (b) priority, (c) fairness,
and so on. Windows has supported symmetric multiprocessing (SMP) since NT4, so
threads can be allocated to separate processors within a system.
Therefore, each Windows process includes resources such as the following components:
• One or more threads.
• A virtual address space that is distinct from other processes' address spaces,
except where memory is explicitly shared. Note that shared memory-mapped
files share physical memory, but the sharing processes will use different
virtual addresses to access the mapped file.
• One or more code segments, including code in DLLs.
• One or more data segments containing global variables.
• Environment strings with environment variable information, such as the
current search path.
• The process heap.
• Resources such as open handles and other heaps.
Each thread in a process shares code, global variables, environment strings, and

6
resources. Each thread is independently scheduled, and a thread has the following
elements:
• A stack for procedure calls, interrupts, exception handlers, and automatic storage.
• Thread Local Storage (TLS)—arrays of pointers giving each thread the ability to
allocate storage to create its own unique data environment.
• An argument on the stack, from the creating thread, which is usually unique for each
thread.
• A Context Structure maintained by the kernel, with machine registers values.
Windows 2000 has a number of concepts for managing the CPU and grouping
resources together. In the following section we will study these concepts.
Windows 2000 supports traditional process that communicates and synchronizes with
each other. Each process contains at least one thread, which contains at least one fiber
(a lightweight thread). Processes combine to form a job for certain resource
management purposes. And jobs, processes, threads, and fibers provides a very
general set of tools for managing parallelism and resources.
• Job: collection of processes that share quotas and limits
• Process: container for holding resources
• Thread: Entity scheduled by the kernel
• Fiber: Lightweight thread managed entirely in user space.
A job in Windows 2000 is a collection of one or more processes. There are quotas
(maximum number of processes, total CPU time, memory usage) and resource limits
associated with each job, store in the corresponding job object.
Every process has a 4-GB address space, with the user occupying the bottom 2 GB (3
GB on advanced server and Datacenter Server) and operating system occupying the
rest. Process is created using Win32 call and consist of a process ID, one or more
threads, a list of handles, and an access token containing security related information.
Each process starts out with one thread and new threads can be created dynamically
using a win32 call. Operating system selects a thread to run for CPU scheduling.
Every thread has a state like ready, running, blocked, etc. Every thread has a thread
ID, which is taken from the same space as the process IDs, so an ID can never be in

7
use for both a process and a thread at the same time. Processes and thread can be used
as byte indices into kernel tables, as they are in multiple of four. A thread is normally
run in user mode, but when it invokes a system call it switches to kernel mode. There
are two stacks for each thread, one for use when it is in user mode and one for use
when it is in kernel mode. A thread consists of the following
• Thread ID
• Two stacks
• A context (to save its register when not running)
• A private are for its own local variables and
• Possibly its own access token. If a thread has its own access token, this variable
overrides the process access token in order to let client threads pass their access
rights to server threads who are doing work for them.
Threads are a scheduling concept and not a resource ownership concept. In addition
to normal threads that run in user processes, Windows 2000 provides a number of
daemon threads (associated with the special system or idle processes) that runs in
kernel space and are not linked or associated with any user process. Switching
threads in Windows 2000 are relatively expensive, as they require entering and
exiting kernel mode. Further, Windows 2000 provides fibers, which are similar to
threads, but are scheduled in user space by the originating program (or its run time
system). A thread can have multiple fibers. There are no executive objects relating to
fibers, as there are for jobs, processes, and threads. In fact, the operating system
knows nothing about the fibers and there are no true system calls for managing fibers.
Windows 2000 is capable of running on a symmetric multiprocessor system. There is no
central scheduling thread in Windows 2000 operating system. But when a
thread cannot run any more, the thread moves to kernel mode and runs the scheduler
itself to see which thread to switch to and the concurrency control is reached through
the following conditions
• Thread blocks on a semaphore, mutex, event, I/O, etc.: In this situation the
thread is already running in kernel mode to carry out the operation on the
dispatcher or I/O object. It cannot possibly continue, so it must save its own

8
context, run the scheduler to pick its successor, and load that threat’s context to
start it.
• It signals an object – In this situation, thread is running in kernel mode and
after signaling some object it can continue as signaling an object never blocks.
Thread runs the scheduler to verify if the result of its action has created a
higher priority thread. If so, a thread switch occurs because Windows 2000 is
fully pre-emptive.
• The running thread’s quantum expires: In this case, a trap to kernel mode
occurs, thread executes the scheduler to see who runs next. The same thread
may be selected again and gets a new quantum and continue running, else a
thread switch takes place.

9
 4. Memory Management

Windows 2000 consists of an advanced virtual memory management system. It provides

a number of Win32 functions for using it and part of the executives and six dedicated
kernel threads for managing it. In Windows 2000, each user process has its own virtual
address space, which is 32 bit long (or 4 GB of virtual address space). The lower 2 GB
minus approx. 256 MB are reserved for process’s code and data; the upper 2 GB map
onto to kernel memory in a protected way. The virtual address space is demand paged
with fixed pages size. The bottom and top 64 Kb process virtual space is normally
unmapped. This is done
intentionally to catch programming errors as invalid pointers are often 0 or –1. From
64 KB onward comes the user’s private code and data, which extends upto 2 GB.
Some system counters and timers are available at high end of 2 GB. This makes them
visible and allows processes to access them without the overhead of a system call.
The next 2 GB of virtual address space contains the operating system, code, data,
paged and non-paged pools. The upper 2 GB is shared by all user processes, except
page tables, which are exclusively reserved for each process’ own page table. The
upper 2 GB of memory is not writable and mostly not even readable by user-mode
processes. When a thread makes a system call, it traps into kernel mode and keeps on
running in the same thread. This makes the whole OS and all of its data structure
including user process visible within thread’s address space by switching to thread’s
kernel stack. This results in less private address space per process in return for faster
system calls. Large database server feel short of address space, and that is why 3-GB
user space option is available on Advanced Server and Datacenter server. Free and
reserved pages do not consist of shadow pages on disk and a reference to these pages
cause page fault. The shadow pages on the disk are arranged into one or more paging
files. It is possible to have 16 paging files, spread over 16 separate disks, for higher I/O
bandwidth, each created with an initial and maximum size. These files can be created at
the maximum size at the time of system installation to avoid fragmentation. Like many
versions of UNIX, Windows 2000 allows files to be mapped directly onto the virtual
address spaces. A mapped file can be read or written using ordinary memory references.
Memory-mapped files are implemented in the same way as other committed pages, only
the shadow pages are in the user’s file instead of in the paging file. Due to recent writes to

10
the virtual memory, the version in memory may not be identical to the disk version. On
unmapping or explicitly flushing, the disk version is
brought up to date. Windows 2000 permits two or more processes to map onto to the
same portion of a file at the same time, at different virtual addresses as depicted in
Figure 5. The processes can communicate with each and pass data back and forth at
very high bandwidth, since no copying is required. The processes may have different
access permissions. The change made by one process is immediately visible to all the
others, even if the disk file has not yet been updated. There is another technique called
copy-on-write, where data can be safely written without affecting other users or the
original copy on disk. This is to handle a situation where two programs share a DLL file
and one of them changes the file’s static data. To allow the programs to use more physical
memory than fit in the address space, there is technique to place a piece of code at any
virtual address without relocation is called position independent code. There is a
technique called bank switching in which a program, in which program could substitute
some block of memory above the 16-bit or 20-bit limit for a block of its own memory.
When 32- bit machine came, it was thought that there would be enough address space
forever. Now large programs often need more than the 2 GB or 3 GB of user address
space Windows 2000 allocates to them, so bank switching is back, now called address
windowing extensions. This technique is only used on servers with more than 2 GB of
physical memory.
These functions operate on a region having one or a sequence of pages that are
consecutive in the virtual address space. To minimize porting problems to upcoming
architectures with pages larger than existing ones, allocated regions always begin on
64-KB boundaries. Actual address space is in multiple of 64 KB. Windows 2000 has
a API function to allow a process to access the virtual memory of a different process
over which it has been given control or handle. The operating system can use 4-MB
pages to reduce page table space consumed.
Whereas the scheduler selects individual threads to run and does not care much about
the processes, the memory manager deals with processes and does not care much
about threads. As and when virtual address space is allocated for a process, the
memory manager creates a VAD (Virtual Address Descriptor). VAD consists of a
range of addresses mapped, the backing store file and offset where it is mapped, and
the protection code. On touching the first page, the directory of page tables is created

11
and pointer to it added in the VAD. It is pertinent to note that Windows 2000 does not
read in isolated pages from the
disk, but reads in runs of consecutive pages to minimize disk transfers. The run size is
larger for code pages than for data pages.
In Windows 2000 entire paging system makes heavy use of the working set concept.
Every process has a working set and this set consists of the mapped-in pages that are
in memory. The size and composition of the working set fluctuates as the process’
thread run. Working set is described by two parameters: minimum size and the
maximum size and there are hard bounds. The default minimum is in the range 20-50
and the default initial maximum is in the range 45-345 depending on the total amount
of RAM.
Windows 2000 uses a local algorithm, to prevent one process from obstructing other
by hogging memory. The page is added if the working set is smaller than the
minimum on occurrence of a page fault. If the working set is larger than the
maximum, a page is evicted from the working set to make room for the new page.
System also tries to tune to the situation and algorithm may be a mix of local and
global. The last 512 pages are left for some slack for new processes.
In general, Windows 2000 resolves various conflicts through complex heuristics,
guesswork, historical precedent, rules of thumb, and administrator-controlled
parameter setting. Memory management is a highly complex subsystem with many
data structures, algorithms, and heuristics.

12
 5. Storage Management

Windows 2000 supports several file systems like FAT-16, FAT-32, and NTFS. Windows
2000 also supports read-only file systems for CD-ROMs and DVDs. It is possible to have
access to multiple file system types on the same running system.
NTFS stands for New Technology File System. Microsoft created NTFS to
compensate for the features it felt FAT was lacking. These features include increased
fault tolerance and enhanced security. Individual File names in NTFS are limited to
255 characters; full paths are limited to 32,767 characters. Files are in Unicode. But
Win32 API does not fully support case-sensitivity for file names. NTFS consists of
multiple attributes, each of which is represented by a stream of bytes.
NTFS is a highly complex and sophisticated file system. Each NTFS volume contains
files, directories, bitmaps, and other data structures. These volumes are organized as a
linear sequence of blocks (512 bytes to 64 KB size), which is called clusters in
Microsoft’s terminology. The main data structure in each volume is master file table
(MFT), which is a linear sequence of fixed size 1-KB records. Each MFT describes
one file or directory.
NTFS repairs hard disk errors automatically without displaying an error message.
When Windows 2000 writes a file to an NTFS partition, it keeps a copy of the file in
memory. It then checks the file to make sure it matches the copy stored in memory. If
the copies don't match, Windows marks that section of the hard disk as bad and won't
use it again (Cluster Remapping). Windows then uses the copy of the file stored in
memory to rewrite the file to an alternate location on the hard disk. If the error
occurred during a read, NTFS returns a read error to the calling program, and the
data is lost.
NTFS has many security options. You can grant various permissions to directories
and to individual files. These permissions protect files and directories locally and
remotely. NT operating system was designed to meet the U.S. Department of
Defense’s C2 (the orange book security requirements). Windows 2000 was not
designed for C2 compliance, but it inherits many security properties from NT,
including the following: (1) secure login with anti-spoofing mechanism, (2)
Discretionary access controls, (3) Privileged access controls, (4) Address space
protection per process, (5) New pages must be zeroed before being mapped in, (6)

13
security auditing.
Every user and group in Windows 2000 is identified by a SID (security ID), which
includes a binary numbers with a short header followed by a long random
component. The purpose is to get a unique SID worldwide. The process and its
threads run under the users’ SID. And only threads with authorized SIDS can access
objects. Each process has an access token which possess its SID and other
information.
NTFS also includes the Encrypting File System (EFS). EFS uses public key security
to encrypt files on an NTFS volume, preventing unauthorized users from accessing
those files. This feature comes in quite handy on a portable compute, for example.
Lose a portable, and the files on its disk are fair game to anyone who knows how to
get to them. EFS use 128-bit (40-bit internationally) Data Encryption Standard (DES)
encryption to encrypt individual files and folders. Encryption keys are implemented
on a Windows 2000 domain or in the case of a standalone computer or locally. The
operating system generates a recovery key so administrators can recover encrypted
data in the event that users lose their encryption key.
Another advantage to NTFS is native support for file compression. The NTFS
compression offers you the chance to compress individual files and folders of your
choice. Disk quotas allow administrators to manage the amount of disk space allotted to
individual users, charging users only for the files they own. Windows 2000 enforces
quotas on a per-user and per-volume basis.
The Windows 2000 cache manager does caching and conceptually it is similar to
other systems. However, its design has some unusual properties.
Windows 2000 has single integrated cache that works for all file systems in use.
Separate file systems do not need to maintain their respective cache. The operation
of cache manager is shown in Figure below: operates at a higher level than the file
systems. Windows 2000 cache is organized by virtual block, not physical blocks. The
traditional file caches keep track of blocks by two-part addresses of the form
(partition (denotes device and partition), block (block no.)). In Windows 2000, cache
manager uses (file, offset) to refers to a block.

14
 Conclusion

Windows 2000 structure consists of the HAL, the kernel, the executive, and a thin system
services layer that catches incoming system calls. There are also a variety of device
drivers, file systems and GDI. The HAL layer provides hardware independence and hides
differences in hardware from the upper layer. And the kernel hides the remaining
differences from the executive to make it almost machine independent. The user
processes create Windows 2000 executive who is based on memory objects. User
processes get back handles to manipulate them at later. Objects can be created by the
executive components and object manager possess a name space where objects can be
inserted for subsequent references. Windows 2000 operating system supports processes,
jobs, threads, and fibers. Processes consist of virtual address spaces, which are container
for resources. Threads are the unit of execution, which are scheduled by the operating
system. Lightweight threads or fibers are scheduled entirely in user space. Resources
quotas are assigned by jobs, which is a collection of processes. Priority algorithm is used
for scheduling. Windows 2000 has a demand-paged virtual memory and the paging
algorithm is based on the working set concept. There several lists of free pages. On
occurrence of page fault, a free page is made available. Pages that have not been used for
a long time are fed by trimming the working set using complex formulas. Device drivers
do I/O, which is based on the windows device model. Initializing a driver object those
possess the addresses of the procedures that the system can call to add devices or perform
I/O. Further activates a device driver; drivers can be stacked to act as filters. The
Windows 2000 NTFS file system is based on a master file table with one record per file
or directory. Multiple attributes of a file can be in the MFT record or nonresident, on disk.
NTFS also supports compression and encryption.

15