Chapter 20 · Windows Storage Architecture

Knowledge Check

9 min read

Try to answer before you open the answers. Guessing is fine; checking your guess is how you learn.

QUICK REVIEW (5 minutes)

  1. Name the layers an application's read request passes through, from the app down to the miniport.
  2. What is an IRP?
  3. What is the difference between a partition and a volume?
  4. How many primary partitions can MBR hold, and what is its size limit with 512-byte sectors?
  5. What is the protective MBR in a GPT disk?
  6. Which partition holds the UEFI boot files?
  7. Why do A: and B: usually not appear as hard-disk letters?
  8. What is a volume GUID path?
  9. Name the four resiliency types of Storage Spaces.
  10. Which miniport driver runs an NVMe SSD, and which runs a SATA drive in AHCI mode?

ANSWER KEY — DO NOT READ UNTIL YOU'VE ANSWERED

Click to reveal answers

1. The layers

Application → Win32 API (CreateFile, ReadFile) → I/O Manager → file system driver (ntfs.sys) → volume manager and filter drivers → partition manager (partmgr.sys) → disk class driver (disk.sys) → storport (storport.sys) → miniport (stornvme.sys or storahci.sys) → hardware.

2. IRP

An I/O Request Packet: the form the I/O Manager builds and passes down the driver chain describing one request.

3. Partition vs volume

A partition is a range of sectors listed in the partition table. A volume is a storage area with a file system that Windows can mount, usually a formatted partition.

4. MBR limits

4 primary partitions, and about 2 TB (2³² sectors × 512 bytes).

5. Protective MBR

A fake MBR at LBA 0 saying the whole disk is one partition of unknown type, so MBR-only tools do not treat the disk as empty and overwrite it.

6. EFI System Partition

The ESP, a small FAT32 partition (roughly 100–260 MB).

7. A: and B:

They were reserved for floppy disks in early PCs, so hard-disk volumes start at C:.

8. Volume GUID path

\\?\Volume{GUID}\: the permanent name of a volume that does not depend on a drive letter.

9. Resiliency types

Simple, two-way mirror, three-way mirror and parity.

10. Miniports

stornvme.sys for NVMe, storahci.sys for SATA in AHCI mode.

UNDERSTANDING QUESTIONS

Q1. Why is the storage stack built from many layers instead of one big driver?

Answer Each layer can change without the others. A new file system, a new SSD interface, or a feature such as BitLocker only touches one layer. Shared parts (class driver, storport) are written once, and only a small miniport is written per controller, which makes drivers shorter and safer.

Q2. Why can a 4 TB disk not be fully used under MBR, and how does GPT fix that?

Answer MBR stores sector addresses in 32 bits, so it can address 2³² sectors. With 512-byte sectors that is 2 TiB. GPT uses 64-bit addresses, so the limit is far larger than any real disk.

Q3. Why does GPT store a backup copy of its header and entries at the end of the disk?

Answer So that damage to the start of the disk does not destroy the map. Checksums (CRC32) show when the primary copy is bad, and tools can rebuild it from the copy at the end. MBR has only one copy and no checksum.

Q4. What is the benefit of a folder mount point over a drive letter?

Answer It does not use up one of the 26 letters, and it lets you grow a folder's space by mounting a bigger volume there while paths stay the same. Programs keep using the same folder path.

Q5. Why is a mirror in Storage Spaces not a backup?

Answer A mirror protects against a **disk failing**, because the data is on two disks. But a deleted file, a virus or ransomware is changed on both copies at once, and so is a fire or theft. Backups must be separate and ideally off-site.

SCENARIO QUESTIONS (Troubleshooting)

S1. You plug a new 4 TB disk into an old PC and Windows only shows 2 TB. What is the likely cause?

Answer The disk was initialized as **MBR**, which is limited to about 2 TB with 512-byte sectors. Back up (a new disk is empty), then initialize or convert it as **GPT**. Check `Get-Disk` for PartitionStyle first.

S2. You want to extend C: but the "Extend Volume" option is greyed out, and there is a recovery partition right after it. What is happening?

Answer Extending needs **unallocated space directly after** the partition. The recovery partition is in the way. Options include moving or recreating the recovery partition with proper tools, or using another disk. Do not delete it blindly; it holds repair tools.

S3. After plugging in a USB stick, your backup program cannot find "E:\Backup" because the stick got F: this time. How could this be avoided?

Answer Letters are assigned by the Mount Manager and can differ when another volume already holds the letter. Fix: assign a fixed letter in Disk Management, or point the program to the **volume GUID path** or a **mount point** instead of a letter.

S4. The PC freezes for a few seconds now and then, and Event Viewer shows "reset to device \Device\RaidPort0 was issued" from storahci. What is the story?

Answer Storport sent a command to a SATA device that did not answer in time, so it reset the controller. Likely causes are a failing drive, a bad SATA cable or port, or a power problem. Back up first, check drive health (`Get-PhysicalDisk` HealthStatus), and try another cable.

S5. A freshly attached disk shows "Not Initialized" in Disk Management. Is it broken?

Answer Not necessarily. It simply has no partition table. If the disk is new, initialize it (choose GPT) and create a volume. If the disk **should hold data**, do not initialize it: that can make recovery harder. Check the cable first, or try the disk in another PC.

INTERVIEW QUESTIONS

I1. Describe the Windows storage stack from CreateFile down to the hardware.

Answer `CreateFile`/`ReadFile` calls go to the I/O Manager, which builds an IRP. The file system driver (NTFS) maps file ranges to volume blocks. Volume and partition managers (with filter drivers such as BitLocker and shadow copies) map them to disk blocks. `disk.sys` builds a SCSI-style command, `storport.sys` queues it and handles timeouts, and a miniport (`stornvme.sys` or `storahci.sys`) writes it to the controller. The device uses DMA to move data and raises an interrupt to complete the IRP.

I2. Explain the difference between a physical disk, a partition, a volume and a drive letter.

Answer A physical disk is the hardware. A partition is a range of sectors recorded in the partition table. A volume is a partition (or virtual disk) with a file system that Windows mounts. A drive letter is an optional name assigned to a volume by the Mount Manager; a volume may have none, or be mounted in a folder instead.

I3. Compare MBR and GPT.

Answer MBR: sector 0, 446 bytes boot code, 4 partition entries, `55 AA`, 32-bit addresses (about 2 TB), single copy, Legacy BIOS. GPT: protective MBR, primary header at LBA 1, up to 128 entries in the standard Windows layout, 64-bit addresses, CRC checks, backup copy at the end, required for booting Windows through UEFI and for disks over 2 TB.

I4. What are Storage Spaces, and how do they differ from dynamic disks and hardware RAID?

Answer Storage Spaces is a software feature that pools physical disks and makes virtual disks with resiliency (simple, mirror, parity) and thin provisioning. Dynamic disks are an older, now legacy way to span and mirror volumes. Hardware RAID does a similar job in a separate controller chip. Storage Spaces uses mixed drives, needs no special card and is Microsoft's preferred approach.

I5. How do storport and a miniport divide the work, and why is NVMe faster than AHCI?

Answer Storport provides common services: queues, timeouts, resets, power and hot-plug support. The miniport knows one controller's registers and command format. NVMe is faster because it supports many deep queues (one per core), uses MSI-X interrupts per queue, and sits on PCIe, whereas AHCI has one queue of 32 commands on a SATA link.

PRACTICAL TASK

Draw a one-page "storage map" of your PC. Using the results of the Practical Lab, draw each physical disk as a long bar. Split every bar into its partitions, label each with its size, file system and drive letter (or "no letter"), and mark which disks are GPT or MBR. Next to the system disk, write the names of the driver layers (partmgr.sys, disk.sys, storport.sys, and the miniport you found).

Why This Matters

When something goes wrong with storage (a missing drive, a full C:, a failing disk), the map shows where each piece lives and which layer might be responsible. It also helps you avoid risky clicks in Disk Management.

CHAPTER SUMMARY

  • The storage stack passes a request through Win32 API, I/O Manager, file system, volume and partition managers, disk.sys, storport.sys and a miniport, down to the hardware.
  • A physical disk holds partitions; a formatted partition (or virtual disk) is a volume; a drive letter is only one of its names.
  • MBR is the old scheme (4 primary partitions, about 2 TB). GPT is the modern scheme (many partitions, 64-bit, backup copy, UEFI boot). The typical Windows GPT layout is ESP, MSR, C: and recovery.
  • Volumes can be reached by drive letter, folder mount point or volume GUID path. The Mount Manager hands out and remembers letters.
  • Storage Spaces pools disks into virtual disks with simple, mirror or parity resiliency and thin provisioning. A mirror is not a backup.
  • Disk drivers: class driver disk.sys, port driver storport.sys, miniports stornvme.sys and storahci.sys, using queues, DMA and interrupts.