Concept - Fixup

Overview

The smallest unit of disk space that NTFS uses is a Cluster. This can vary from one sector to 128 sectors, the usual number is 8 (4KB). Naturally this is dependent on the sector and Cluster. sizes declared in $Boot.

Because a single sector could fail, it's important for NTFS to be able to detect errors in a cluster. For this purpose the sectors have Fixups, which are kept in an Update Sequence Array.

Many important Metadata Records use fixups to protect data integrity

What Does It Do?

The header of each of these records contains a Update Sequence Number and a buffer. The last two bytes of each sector of the record are copied into the buffer and the Update Sequence Number is written in their place.

When the record is read, the Update Sequence Number is read from the header and compared against the last two bytes of each sector. If it succeeds, then it copies the bytes in the buffer back to their original places.

Example

Here's an example before the fixup is applied, with a cluster size of 2KB (4 Sectors).

Offset	Data								Description
0x0000	...								Header
0x0028	CD	AB							Update Sequence Number
0x002A	00	00	00	00	00	00	00	00	Update Sequence Array
...	...
0x01F8	11	12	13	14	15	16	17	18	End of Sector 1
...	...
0x03F8	21	22	23	24	25	26	27	28	End of Sector 2
...	...
0x05F8	31	32	33	34	35	36	37	38	End of Sector 3
...	...
0x07F8	41	42	43	44	45	46	47	48	End of Sector 4

Here the Update Sequence Number is 0xABCD and the Update Sequence Array is still empty.

Offset	Data								Description
0x0000	...								Header
0x0028	CD	AB							Update Sequence Number
0x002A	17	18	27	28	37	38	47	48	Update Sequence Array
...	...
0x01F8	11	12	13	14	15	16	CD	AB	End of Sector 1
...	...
0x03F8	21	22	23	24	25	26	CD	AB	End of Sector 2
...	...
0x05F8	31	32	33	34	35	36	CD	AB	End of Sector 3
...	...
0x07F8	41	42	43	44	45	46	CD	AB	End of Sector 4

The last two bytes of each sector have been copied into the Update Sequence Array, and the Update Sequence Number has been written over the last two bytes of each sector.

The Details

Writing

Before writing a fixup-protected record:

Add one to the Update Sequence Number (0x0000 must be skipped)
For each sector, copy the last two bytes into the Update Sequence Array
Write the new Update Sequence Number to the end of each sector
Write the record to disk

Reading

When reading a fixup-protected record:

Read the record from disk
Check the magic number is correct
Read the Update Sequence Number
Compare it against the last two bytes of every sector
Copy the contents of the Update Sequence Array to the correct places

If any of the checks fail when reading, it could mean there is: a bad sector, disk corruption or a fault in the driver.