LOGO.SYS is a system file that is used as part of the startup process found in the Windows 9x family of operating systems such as Windows 95, Windows 98 and Windows Me to display their boot screens. It is not present in the Windows NT family of operating systems such as Windows NT 4.0, Windows 2000 and Windows XP, as they used various different methods to display their boot screens.
LOGO.SYS is the "Starting Windows" message, with the Windows logo. The file is located in the root directory of the boot drive. This is usually C:\, but with drive compression, like DriveSpace, this is the host drive (often H:\). The default LOGO.SYS file is also stored in IO.SYS and used by MS-DOS during startup if LOGO.SYS could not be found. The display of the logo can be disabled by adding a LOGO=0 setting to the Options section in the MS-DOS 7 configuration file MSDOS.SYS.
LOGOW.SYS is the "Please wait while your computer shuts down" (later "Windows is shutting down" in Windows 98) message. The file is located in the Windows directory, which by default is C:\WINDOWS. The Windows logo is only shown in Windows 95 and 98 (in Windows 95, only the "Microsoft Windows 95" wordmark is displayed). Windows Me simply cuts to black after shutting down or cuts to the LOGOS.SYS screen as it lacks a LOGOW.SYS screen of its own (even if the LOGOW.SYS file is provided in the OS, the shut down screen will still not be displayed for obvious reasons). No error will be shown if the file cannot be found.
LOGOS.SYS is the "It's now safe to turn off your computer" message. The file is located in the Windows directory. This message is displayed when Windows has successfully shut down to MS-DOS but is not configured to return to the prompt (COMMAND.COM) again. On systems with proper ACPI support and ATX power supply, the PC may power down instead. If the file cannot be found, the same message is displayed in text mode. No error will be shown if the file cannot be found.
LOGO.SYS is in fact an 8-bit RLE-encoded Windows bitmap file with a resolution of exactly 320×400 pixels at 256 colors. This is displayed in the otherwise little-used 320x400 VGA graphics mode, a compromise to allow the display of a 256-color image with high vertical (but not horizontal) resolution on all compatible systems, even those with plain VGA cards (which could only show 16 colors with high horizontal resolution) and without needing any additional graphics drivers. The mode appears, to any attached monitor, to be identical to the more common 640x400 graphics or 720x400 text modes, and is therefore stretched to a standard 4:3 aspect ratio (meaning the pixels appear to be 1.67x (2/1.2) wider than they are tall, instead of square - as they would be on a full 640x480 VGA display) on a typical 4:3 monitor of the time, and on monitors of other shapes (5:4, 16:9, etc.) when set to display standard video modes in their original aspects with letterbox borders. This lent the startup screens a peculiar, characteristic "feel" and made them more suited to certain subjects (which disguised the horizontal blockiness or made good use of the vertical resolution) than others (which accentuated it), meaning some skill was needed in choosing an image that would still be aesthetically pleasing - or even clear enough to be properly interpreted - once resized.
For LOGO.SYS or the equivalent embedded image in IO.SYS, Windows will also animate the image's color information using palette rotation; the image is static, but may have the illusion of movement as colors are changed.
As the files are standard RLE-compressed .BMPs (with an entirely optional custom tag segment) renamed to ".SYS", they may be opened and edited using image editing tools such as MS Paint, and the contents replaced with user-selected pictures; the only conversion needed is to change the file extension, and to ensure they are in the correct resolution and color depth (with dithering if needed). However, the process is not foolproof:
Ensuring the aspect ratio is correct can be confusing, as it is usually displayed in a horizontally compressed form on a screen with square pixels (the most reliable method being to edit at full size, crop to 4:3, then resize to 320x400)
The loading indicator animation was created using palette rotation. The number of palette entries to rotate is determined by the otherwise seldom used biClrImportant field of the BITMAPINFOHEADER structure. Image editing software usually discarded this data, so it was often not possible to retain it. Some logo creation utilities were specifically created to restore the cycling function and allow creating custom animations.
Just like the bootsplash screens in earlier versions of Windows, there was a hard but poorly documented limit on how large the compressed file could be, because of the very limited memory available during the boot process (the very reason that RLE was used in the first place - a plain BMP would have been 125kb and thus entirely too large; the default images are around 10 to 70kb each). If the file was too large, it would either simply fail to display or cause the system to crash, which required the user to reboot and drop into DOS mode before the logo had a chance to load, and either delete it or rename it to prevent the system trying to display it again before it could be fixed or replaced. Staying below, and moreover editing an image to bring it below this limit was an imprecise science that mostly required taking advantage of the particular characteristics of RLE, e.g. ensuring there were sufficient areas of the screen with long horizontal runs of the same color, by reducing the dither quality or color reduction mode, shrinking it slightly and adding a black border a few pixels wide all around, etc. Each run allowed a two byte code to represent a strip many pixels wide, and hence blank spaces or areas of flat color compressed very tightly, whereas regions with no repeated colors at all were at best uncompressed, at worst slightly larger than they would otherwise have been.
