NTFS Documentation: $Boot

Definition

This is the system file that allows the system to boot.

Layout

The first 28 bytes are the same as for FAT boot sectors, except that unused fields are zeroed.

Offset to the beginning of the data stream Length Description
0 3 Jump to the boot loader routine
3 8 System ID: "NTFS "
B 2 Sector size of the storage unit
D 1 Number of sectors per cluster
E 7 Unused
15 1 Media descriptor
16 2 Unused
18 2 Number of sectors per track
1A 2 Number of heads
1C 8 Unused
24 2 Always 00 80?
26 2 Always 00 80?
28 8 Number of sectors in the storage unit
30 8 LCN associated to VCN 0 of the data attribute of $MFT
38 8 LCN associated to VCN 0 of the data attribute of $MFTMirr
40 4 FILE record size in clusters
44 4 Index buffer size in clusters
48 4 Volume serial number
50 D Unused
5D 1A1 Boot loader routine
1FE 2 Magic boot sector ID: AA 55
200 More code. Probably the Windows NT® Loader
End of stream - 200 200 Copy of the first 200 bytes

Media descriptor
F8 for a hard disk

FILE record size in clusters
F6 seems to indicate 1/4

Interest

Because this file begins with a boot sector, it must start at physical cluster 0 (this is the only cluster that NTFS can not move). This forces the data attribute of this file to be non-resident. Consequently, the copy of the boot sector (critical data) can be located anywhere on the volume. For crash recovery purpose, Windows NT® 3.5 puts it in the logical middle of the volume, and Windows NT® at the end of the volume.

Regis Duchesne
Last modified: Mon Feb 15 06:56:02 PST 1999