| Glossary |
This is the system file that allows the system to boot. This metadata file points at the boot sector of the volume. It contains information about the size of the volume, clusters and the MFT. It is the only file that cannot be relocated.
| Type | Description | Name |
|---|---|---|
| 0x10 | $STANDARD_INFORMATION | |
| 0x30 | $FILE_NAME | $Boot |
| 0x50 | $SECURITY_DESCRIPTOR | |
| 0x80 | $DATA | [Unnamed] |
| Offset | Size | Description |
|---|---|---|
| 0x0000 | 3 | Jump to the boot loader routine |
| 0x0003 | 8 | System Id: "NTFS " |
| 0x000B | 2 | Bytes per sector |
| 0x000D | 1 | Sectors per cluster |
| 0x000E | 7 | Unused |
| 0x0015 | 1 | Media descriptor (a) |
| 0x0016 | 2 | Unused |
| 0x0018 | 2 | Sectors per track |
| 0x001A | 2 | Number of heads |
| 0x001C | 8 | Unused |
| 0x0024 | 4 | Usually 80 00 80 00 (b) |
| 0x0028 | 8 | Number of sectors in the volume |
| 0x0030 | 8 | LCN of VCN 0 of the $MFT |
| 0x0038 | 8 | LCN of VCN 0 of the $MFTMirr |
| 0x0040 | 4 | Clusters per MFT Record (c) |
| 0x0044 | 4 | Clusters per Index Record (c) |
| 0x0048 | 8 | Volume serial number |
| ~ | ~ | ~ |
| 0x0200 | Windows NT Loader |
(a) A media descriptor of 0xF8 means a hard disk.
(b) A value of 80 00 00 00 has been seen on a USB thumb drive which is
formatted with NTFS under Windows XP. Note this is removable media
and is not partitioned, the drive as a whole is NTFS formatted.
(c) This can be negative, which means that the size of the MFT/Index record
is smaller than a cluster. In this case the size of the MFT/Index
record in bytes is equal to 2^(-1 * Clusters per MFT/Index record).
So for example if Clusters per MFT Record is 0xF6 (-10 in decimal), the
MFT record size is 2^(-1 * -10) = 2^10 = 1024 bytes.
The first 40 bytes are the same as for FAT boot sectors, except that unused fields are zeroed.
Because this file begins with a boot sector, it must start at physical cluster 0 (this is the only cluster that NTFS can not move). This forces the data attribute of this file to be non-resident. Consequently, the copy of the boot sector (critical data) can be located anywhere on the volume.
For crash recovery purposes Windows NT 3.51 saves a copy of the boot sector and puts it in the logical middle of the volume. Windows NT and later put it at the end of the volume.