View Single Post
  #5  
Old February 26th 06, 10:59 PM posted to microsoft.public.win98.disks.general
external usenet poster
 
Posts: n/a
Default Forensic information requested.

"KA1oxd" wrote in message ...
.. but I thought the hard disk
is not written to show that the system was shut down properly until other
parts of the OS sub systems have been terminated. I believe that just before
the OS shuts down the disk subsystem, it writes that information to the
drive, terminates the disk subsystem, then terminates the win32 program as
the last phase.


Probably generally correct. Of course, you can't write the "dirty/clean" flags without
disk access. And you can't terminate Windows fully until the disk access is
complete.