Ntblog.txt while booting in normal Mode and Safe mode:
While booting normally Ntblog.txt file consists of records of Services, drivers and devices that were loaded during this process by windows. It also shows Services, drivers and devices which were not loaded in booting process.
While booting in safe mode it consist of same list but some services are reduced in safe mode which can be known through comparing both files.
Ntblog.txt shows loaded List by words ‘Loaded Drivers’ and which drivers and devices were not loaded by ’Did not load Driver’ so by reading that we can know the list of loaded services, devices and derivers during boot process .
Comparing Ntblog.txt in Normal and Safe Modes:
If windows is not booting properly in normal boot then by comparing Ntblog.txt in normal and safe mode we can know the reason behind malfunctioning of windows. We need to just compare both list Loaded Drivers and did not load Driver. By comparing these two lists of normal boot and safe mode boot we can easily know that which device or driver did not loaded in normal mode and did not loaded in safe mode. Now we can use driver manager to fix problematic driver. If the list showing same records and all drivers and devices were loaded successfully then we know that it’s because of some services run by windows in normal mode which do not run in safe mode so now we can fix this issue by disabling these services one by one and restarting again and again till you find the problematic service. If computer has no problem in booting in normal mode then the difference between normal mode Ntblog.txt and safe mode Ntblog.txt is that some services do not load in safe mode and these services are loaded in normal mode by windows .
References
June, J. P., & Dan, O. (2009). Computer Concepts 2010: New Perspectives. Stamford: Cengage Learning.
Quentin, D., Emmett, D., & Toby, S. (2011). CompTIA A+ Complete Deluxe Study Guide: Exams 220-701 (Essentials) and 220-702 (Practical Application). Hoboken (NJ): John Wiley & Sons.