NTFS file system DBR
DBR of NTFS file system
The effect of boot-sector of NTFS is the same as that of FAT16 and FAT32: MBR boots to DBR of active partition, then DBR boots operating system; for Windows NT/2000/XP/2003, DBR calls unfold NTLDR, and then NTLDR calls in system kernel.
DBR of NTFS
BPB parameter table
Byte offset |
Length |
Common range |
note |
0x0b |
bit |
0x0002 |
number of bytes in each sector |
0x0d |
byte |
0x08 |
number of sectors in each cluster |
0x0e |
bit |
0x000 |
reserved sector |
0x10 |
3byte |
0x000000 |
always 0 |
0x13 |
bit |
0x0000 |
free NTFS, 0 |
0x15 |
byte |
0xf8 |
medium description |
0x16 |
bit |
0x0000 |
always 0 |
0x18 |
bit |
0x3f00 |
number of sectors in each track |
0x1a |
bit |
0xff00 |
number of heads |
0x1c |
Double bit |
0x3f000000 |
hidden sector |
0x20 |
Double bit |
0x00000000 |
free NTFS, 0 |
0x24 |
Double bit |
0x80008000 |
free NTFS, 0 |
0x28 |
8byte |
0x4af57f0000000000 |
total number of sectors |
0x30 |
8byte |
0x0400000000000000 |
logic start cluster number of $MFT |
0x38 |
8byte |
0x54ff070000000000 |
logic start cluster number of $MFTMirr |
0x40 |
Double bit |
0xf6000000 |
cluster record number of each MFT |
0x44 |
Double bit |
0x01000000 |
number of index cluster |
0x48 |
8byte |
0x14a51b74c91b741c |
volume lable |
0x50 |
Double bit |
0x00000000 |
checks the sum |
In NTFS volume, there is an extended BPB formed by data fields that follow the BPB. Data in these fields enables NTLDR to find master file table $MFT in starting process. In the NTFS volume, $MFT isn't placed in a pre-definition sector, which is different from that in FAT16 volume and FAT32 volume. So if there is some bad sectors in normal position of MFT, we can move the $MFT to another place. But, if the data is destroyed, the position of $MFT cannot be found out; then Windows 2000 will consider this volume as unformatted. Therefore, if a NTFS volume prompt unformatted, it is possible that $MFT is not destroyed. And it may reconstruct BPB according to the meaning of each fields of BPB.
|
