Home | Files | Attributes | Concepts | Glossary | Help |
This is the system file that allows the system to boot. This metadata file points at the boot sector of the volume. It contains information about the size of the volume, clusters and the MFT. It is the only file that cannot be relocated.
Type | Description | Name |
---|---|---|
0x10 | $STANDARD_INFORMATION | |
0x30 | $FILE_NAME | $Boot |
0x50 | $SECURITY_DESCRIPTOR | |
0x80 | $DATA | [Unnamed] |
Offset | Size | Description |
---|---|---|
0x0000 | 3 | Jump to the boot loader routine |
0x0003 | 8 | System Id: "NTFS " |
0x000B | 2 | Bytes per sector |
0x000D | 1 | Sectors per cluster |
0x000E | 7 | Unused |
0x0015 | 1 | Media descriptor (a) |
0x0016 | 2 | Unused |
0x0018 | 2 | Sectors per track |
0x001A | 2 | Number of heads |
0x001C | 8 | Unused |
0x0024 | 4 | Always 80 00 80 00 |
0x0028 | 8 | Number of sectors in the volume |
0x0030 | 8 | LCN of VCN 0 of the $MFT |
0x0038 | 8 | LCN of VCN 0 of the $MFTMirr |
0x0040 | 4 | Clusters per MFT Record (b) |
0x0044 | 4 | Clusters per Index Record |
0x0048 | 8 | Volume serial number |
~ | ~ | ~ |
0x0200 | Windows NT Loader |
(a) A media descriptor of 0xF8 means a hard disk
(b) Occasionally this can be 0xF6, which means 1/4
The first 40 bytes are the same as for FAT boot sectors, except that unused fields are zeroed.
Because this file begins with a boot sector, it must start at physical cluster 0 (this is the only cluster that NTFS can not move). This forces the data attribute of this file to be non-resident. Consequently, the copy of the boot sector (critical data) can be located anywhere on the volume.
For crash recovery purposes Windows NT 3.51 saves a copy of the boot sector and puts it in the logical middle of the volume. Windows NT and later put it at the end of the volume.