Home > Hard Disk Repair > How NTFS File System Works: NTFS Physical Structure (3)

How NTFS File System Works: NTFS Physical Structure (3)

September 17th, 2009

NTFS Boot Sector

The table Boot Sector Sections on an NTFS Volume describes the boot sector of a volume that is formatted with NTFS. When you format an NTFS volume, the format program allocates the first 16 sectors for the boot sector and the bootstrap code.

Boot Sector Sections on an NTFS Volume

Byte Offset Field Length Field Name
0x00 3 bytes Jump instruction
0x03 8 bytes OEM ID
0x0B 25 bytes BPB
0x24 48 bytes Extended BPB
0x54 426 bytes Bootstrap code
0x01FE 2 bytes End of sector marker

On NTFS volumes, the data fields that follow the BPB form an extended BPB. The data in these fields enables Ntldr to find the MFT during startup. On NTFS volumes, the MFT is not located in a predefined sector. For this reason, NTFS can move the MFT if there is a bad sector in the current location of the MFT. However, if the data is corrupted, the MFT cannot be located, and Windows Server 2003 assumes that the volume has not been formatted.

The following example illustrates the boot sector of an NTFS volume that is formatted by using Windows Server 2003. The printout is formatted in three sections:

  • Bytes 0x00– 0x0A are the jump instruction and the OEM ID (shown in bold print).
  • Bytes 0x0B–0x53 are the BPB and the extended BPB.
  • The remaining code is the bootstrap code and the end of sector marker (shown in bold print).

image

The table BPB and Extended BPB Fields on NTFS Volumes describes the fields in the BPB and the extended BPB on NTFS volumes. The fields starting at 0x0B, 0x0D, 0x15, 0x18, 0x1A, and 0x1C match those on FAT16 and FAT32 volumes. The sample values correspond to the data in this example.

Byte Offset Field Length Sample Value Field Name and Definition
0x0B 2 bytes 00 02 Bytes Per Sector. The size of a hardware sector. For most disks used in the United States, the value of this field is 512.
0x0D 1 byte 08 Sectors Per Cluster.The number of sectors in a cluster.
0x0E 2 bytes 00 00 Reserved Sectors. Always 0 because NTFS places the boot sector at the beginning of the partition. If the value is not 0, NTFS fails to mount the volume.
0x10 3 bytes 00 00 00 Value must be 0 or NTFS fails to mount the volume.
0x13 2 bytes 00 00 Value must be 0 or NTFS fails to mount the volume.
0x15 1 byte F8 Media Descriptor. Provides information about the media being used. A value of F8 indicates a hard disk and F0 indicates a high-density 3.5-inch floppy disk. Media descriptor entries are a legacy of MS-DOS FAT16 disks and are not used in Windows Server 2003.
0x16 2 bytes 00 00 Value must be 0 or NTFS fails to mount the volume.
0x18 2 bytes 3F 00 Not used or checked by NTFS.
0x1A 2 bytes FF 00 Not used or checked by NTFS.
0x1C 4 bytes 3F 00 00 00 Not used or checked by NTFS.
0x20 4 bytes 00 00 00 00 The value must be 0 or NTFS fails to mount the volume.
0x24 4 bytes 80 00 80 00 Not used or checked by NTFS.
0x28 8 bytes 1C 91 11 01 00 00 00 00 Total Sectors. The total number of sectors on the hard disk.
0x30 8 bytes 00 00 04 00 00 00 00 00 Logical Cluster Number for the File $MFT. Identifies the location of the MFT by using its logical cluster number.
0x38 8 bytes 11 19 11 00 00 00 00 00 Logical Cluster Number for the File $MFTMirr. Identifies the location of the mirrored copy of the MFT by using its logical cluster number.
0x40 1 byte F6 Clusters Per MFT Record. The size of each record. NTFS creates a file record for each file and a folder record for each folder that is created on an NTFS volume. Files and folders smaller than this size are contained within the MFT. If this number is positive (up to 7F), then it represents clusters per MFT record. If the number is negative (80 to FF), then the size of the file record is 2 raised to the absolute value of this number.
0x41 3 bytes 00 00 00 Not used by NTFS.
0x44 1 byte 01 Clusters Per Index Buffer. The size of each index buffer, which is used to allocate space for directories. If this number is positive (up to 7F), then it represents clusters per MFT record. If the number is negative (80 to FF), then the size of the file record is 2 raised to the absolute value of this number.
0x45 3 bytes 00 00 00 Not used by NTFS.
0x48 8 bytes 3A B2 7B 82 CD 7B 82 14 Volume Serial Number. The volume’s serial number.
0x50 4 bytes 00 00 00 00 Not used by NTFS.
Comments are closed.