The Partition Boot Sector contains information that the file system uses to access the volume. On x86-based computers, the Master Boot Record use the Partition Boot Sector on the system partition to load the operating system kernel files, or in the case of Windows NT, the boot loader.
The Windows NT Partition Boot Sector consists of:
The BIOS Parameter Block (bytes 11 through 35 of the Partition Boot Sector) describes physical parameters of the volume. The extended BIOS Parameter Block begins immediately after the BIOS Parameter Block. The length of this structure is different for FAT and NTFS volumes. The information in the BIOS Parameter Block and the extended BIOS Parameter Block is used by disk device drivers to read and configure volumes.
The Partition Boot Sector is the first 512-byte sector at the beginning of the volume. The sector always ends with 0x55AA, which is a sector signature word that marks the end of the sector.
Table 17.4 describes the fields in the Partition Boot Sector for a volume formatted with the FAT file system. The sample values are the data in the corresponding fields in the hex dump in Figure 17.12, presented later in this section.
Table 17.4 Partition Boot Sector for FAT volumes
Byte Offset (in hex) | Field Length | Sample Value | Meaning | |
00 | 3 bytes | EB 3C 90 | Jump instruction | |
03 | 8 bytes | MSDOS5.0 | OEM Name in text | |
0B | 25 bytes | BIOS Parameter Block | ||
24 | 26 bytes | Extended BIOS Parameter Block | ||
3E | 448 bytes | Bootstrap code | ||
1FE | 2 bytes | 0x55AA | End of sector marker | |
The following figure is a hex printout of the Partition Boot Sector for a FAT volume. The printout is formatted in three sections:
Physical Sector: Cyl 0, Side 1, Sector 1
00000000: EB 3C 90 4D 53 44 4F 53 - 35 2E 30 <.MS-DOS5.0
00 02 08 01 00 .....
00000010: 02 00 02 00 00 F8 C9 00 - 3F 00 10 00 3F 00 00 00 ........?...?...
00000020: 51 42 06 00 80 00 29 CE - 13 46 30 4E 4F 20 4E 41 QB....)..F0NO NA
00000030: 4D 45 20 20 20 20 46 41 - 54 31 36 20 20 20 ME FAT16
33 C0 3.
00000040: 8E D0 BC 00 7C 68 C0 07 - 1F A0 10 00 F7 26 16 00 ....|h......&..
00000050: 03 06 0E 00 50 91 B8 20 - 00 F7 26 11 00 8B 1E 0B ....P.. ..&.....
00000060: 00 03 C3 48 F7 F3 03 C8 - 89 0E 08 02 68 00 10 07 ...H........h...
00000070: 33 DB 8F 06 13 02 89 1E - 15 02 0E E8 90 00 72 57 3.............rW
00000080: 33 DB 8B 0E 11 00 8B FB - 51 B9 0B 00 BE DC 01 F3 3.......Q.......
00000090: A6 59 74 05 83 C3 20 E2 - ED E3 37 26 8B 57 1A 52 .Yt... ...7&.W.R
000000A0: B8 01 00 68 00 20 07 33 - DB 0E E8 48 00 72 28 5B ...h. .3...H.r([
000000B0: 8D 36 0B 00 8D 3E 0B 02 - 1E 8F 45 02 C7 05 F5 00 .6...>....E.....
000000C0: 1E 8F 45 06 C7 45 04 0E - 01 8A 16 24 00 EA 03 00 ..E..E.....$....
000000D0: 00 20 BE 86 01 EB 03 BE - A2 01 E8 09 00 BE C1 01 . ..............
000000E0: E8 03 00 FB EB FE AC 0A - C0 74 09 B4 0E BB 07 00 .........t......
000000F0: CD 10 EB F2 C3 50 4A 4A - A0 0D 00 32 E4 F7 E2 03 .....PJJ...2....
00000100: 06 08 02 83 D2 00 A3 13 - 02 89 16 15 02 58 A2 07 .............X..
00000110: 02 A1 13 02 8B 16 15 02 - 03 06 1C 00 13 16 1E 00 ................
00000120: F7 36 18 00 FE C2 88 16 - 06 02 33 D2 F7 36 1A 00 .6........3..6..
00000130: 88 16 25 00 A3 04 02 A1 - 18 00 2A 06 06 02 40 3A ..%.......*...@:
00000140: 06 07 02 76 05 A0 07 02 - 32 E4 50 B4 02 8B 0E 04 ...v....2.P.....
00000150: 02 C0 E5 06 0A 2E 06 02 - 86 E9 8B 16 24 00 CD 13 ............$...
00000160: 0F 83 05 00 83 C4 02 F9 - CB 58 28 06 07 02 76 11 .........X(...v.
00000170: 01 06 13 02 83 16 15 02 - 00 F7 26 0B 00 03 D8 EB ..........&.....
00000180: 90 A2 07 02 F8 CB 42 4F - 4F 54 3A 20 43 6F 75 6C ......BOOT: Coul
00000190: 64 6E 27 74 20 66 69 6E - 64 20 4E 54 4C 44 52 0D dn't find NTLDR.
000001A0: 0A 00 42 4F 4F 54 3A 20 - 49 2F 4F 20 65 72 72 6F ..BOOT: I/O erro
000001B0: 72 20 72 65 61 64 69 6E - 67 20 64 69 73 6B 0D 0A r reading disk..
000001C0: 00 50 6C 65 61 73 65 20 - 69 6E 73 65 72 74 20 61 .Please insert a
000001D0: 6E 6F 74 68 65 72 20 64 - 69 73 6B 00 4E 54 4C 44 nother disk.NTLD
000001E0: 52 20 20 20 20 20 20 00 - 00 00 00 00 00 00 00 00 R .........
000001F0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 55 AA ..............U.
Figure 17.12 Partition Boot Sector for a FAT volume on x86-based computer
Table 17.5 shows the layout of the BIOS Parameter Block and the extended BIOS Parameter Block. The sample values correspond to data in Figure17.10.
Table 17.5 BIOS Parameter Block and Extended BIOS Parameter Block Fields for FAT volumes
Byte Offset | Field Length |
|
|
0x0B | WORD | 0x0002 | Bytes per Sector. The size of a hardware sector. For most disks in use in the United States, the value of this field is 512. |
0x0D | BYTE | 0x08 | Sectors Per Cluster. The number of sectors in a cluster. The default cluster size for a volume depends on the volume size and the file system. |
0x0E | WORD | 0x0100 | Reserved Sectors. The number of sectors from the Partition Boot Sector to the start of the first file allocation table, including the Partition Boot Sector. The minimum value is 1. If the value is greater than 1, it means that the bootstrap code is too long to fit completely in the Partition Boot Sector. |
0x10 | BYTE | 0x02 | Number of file allocation tables (FATs). The number of copies of the file allocation table on the volume. Typically, the value of this field is 2. |
0x11 | WORD | 0x0002 | Root Entries. The total number of file name entries that can be stored in the root folder of the volume. One entry is always used as a Volume Label. Files with long filenames use up multiple entries per file. Therefore, the largest number of files in the root folder is typically 511, but you will run out of entries sooner if you use long filenames. |
0x13 | WORD | 0x0000 | Small Sectors. The number of sectors on the volume if the number fits in 16 bits (65535). For volumes larger than 65536 sectors, this field has a value of 0 and the Large Sectors field is used instead. |
0x15 | BYTE | 0xF8 | Media Type. Provides information about the media being used. A value of 0xF8 indicates a hard disk. |
0x16 | WORD | 0xC900 | Sectors per file allocation table (FAT). Number of sectors occupied by each of the file allocation tables on the volume. By using this information, together with the Number of FATs and Reserved Sectors, you can compute where the root folder begins. By using the number of entries in the root folder, you can also compute where the user data area of the volume begins. |
0x18 | WORD | 0x3F00 | Sectors per Track. The apparent disk geometry in use when the disk was low-level formatted. |
0x1A | WORD | 0x1000 | Number of Heads. The apparent disk geometry in use when the disk was low-level formatted. |
0x1C | DWORD | 3F 00 00 00 | Hidden Sectors. Same as the Relative Sector field in the Partition Table. |
0x20 | DWORD | 51 42 06 00 | Large Sectors. If the Small Sectors field is zero, this field contains the total number of sectors in the volume. If Small Sectors is nonzero, this field contains zero.. |
0x24 | BYTE | 0x80 | Physical Disk Number. This is related to the BIOS physical disk number. Floppy drives are numbered starting with 0x00 for the A disk. Physical hard disks are numbered starting with 0x80. The value is typically 0x80 for hard disks, regardless of how many physical disk drives exist, because the value is only relevant if the device is the startup disk. |
0x25 | BYTE | 0x00 | Current Head. Not used by the FAT file system. Therefore, Windows NT uses this field to store two flags: The low order bit is a dirty flag, used to indicate that Windows NT should run the Chkdsk program against the volume when it starts. The second lowest bit indicates that a surface scan should also be run. |
0x26 | BYTE | 0x29 | Signature. Must be either 0x28 or 0x29 in order to be recognized by Windows NT. |
0x27 | 4 bytes | CE 13 46 30 | Volume Serial Number. A unique number that is created when you format the volume. |
0x2B | 11 bytes | NO NAME | Volume Label. This field was used to store the volume label, but the volume label is now stored as special file in the root directory. |
0x36 | 8 bytes | FAT16 | System ID. Either FAT12 or FAT16, depending on the format of the disk. |
For the Media Descriptor field, the following table lists some of the recognized media descriptor values and their associated media. A media descriptor value can be associated with more than one disk capacity.
Value | Capacity | Media Size and Type | |
F0 | 2.88 MB | 3.5-inch, 2-sided, 36-sector | |
F0 | 1.44 MB | 3.5-inch, 2-sided, 18-sector | |
F9 | 720 KB | 3.5-inch, 2-sided, 9-sector | |
F9 | 1.2 MB | 5.25-inch, 2-sided, 15-sector | |
FD | 360 KB | 5.25-inch, 2-sided, 9-sector | |
FF | 320 KB | 5.25-inch, 2-sided, 8-sector | |
FC | 180 KB | 5.25-inch, 1-sided, 9-sector | |
FE | 160 KB | 5.25-inch, 1-sided, 8-sector | |
F8 | N/A | Fixed disk | |
Table 17.6 describes the fields in the Partition Boot Sector for a volume formatted with the NTFS file system. The sample values are the data in the corresponding fields in the hex dump in Figure 17.13, presented later in this section.
Table 17.6 Partition Boot Sector for NTFS volume
Byte Offset (in hex) |
|
|
| |
00 | 3 bytes | EB 5B 00 | Jump instruction | |
03 | 8 bytes | NTFS | OEM Identifier | |
0B | 25 bytes | BIOS Parameter Block | ||
24 | 48 bytes | Extended BIOS Parameter Block | ||
54 | 426 bytes | Bootstrap code | ||
1FE | WORD | 0x55AA | End of sector marker | |
Note
The bootstrap code for an NTFS volume is longer than the 426 bytes shown here. When you format an NTFS volume, the format program allocates the first 16 sectors for the Partition Boot Sector and the bootstrap code.
The extra data fields after the BIOS Parameter Block form an extended BIOS Parameter Block for NTFS. The data in these fields enable the boot loader to find the Master File Table (MFT) during the startup process. In the NTFS file system, the MFT is not located in a predefined sector as is the case for the file allocation table on a FAT volume. Thus, the MFT can be moved if there is a bad sector in its normal location. However, if these data are corrupt, the MFT cannot be located and Windows NT assumes the volume has not been formatted.
The following figure is a hex dump of the Partition Boot Sector for an NTFS volume (formatted when running Windows NT 4.0). The printout is formatted in three sections:
Physical Sector: Cyl 407, Side 0, Sector 1
00000000: EB 5B 90 4E 54 46 53 20 - 20 20 20 .[.NTFS
00 02 01 00 00 .....
00000010: 00 00 00 00 00 F8 00 00 - 3F 00 10 00 90 42 06 00 ........?....B..
00000020: 00 00 00 00 80 00 80 00 - A0 3E 06 00 00 00 00 00 .........>......
00000030: 10 00 00 00 00 00 00 00 - 51 1F 03 00 00 00 00 00 ........Q......
00000040: 02 00 00 00 04 00 00 00 - 5B 1F DD 2C 4F DD 2C A2 ........[.,O.,.
00000050: 00 00 00 00 ....
00 00 00 00 - 00 00 00 00 00 FA 33 C0 ..........3.
00000060: 8E D0 BC 00 7C FB B8 C0 - 07 8E D8 C7 06 54 00 00 ....|........T..
00000070: 00 C7 06 56 00 00 00 C7 - 06 5B 00 10 00 B8 00 0D ...V.....[......
00000080: 8E C0 2B DB E8 07 00 68 - 00 0D 68 56 02 CB 50 53 ..+....h..hV..PS
00000090: 51 52 06 66 A1 54 00 66 - 03 06 1C 00 66 33 D2 66 QR.f.T.f....f3.f
000000A0: 0F B7 0E 18 00 66 F7 F1 - FE C2 88 16 5A 00 66 8B .....f......Z.f.
000000B0: D0 66 C1 EA 10 F7 36 1A - 00 88 16 25 00 A3 58 00 .f....6....%..X.
000000C0: A1 18 00 2A 06 5A 00 40 - 3B 06 5B 00 76 03 A1 5B ...*.Z.@;.[.v..[
000000D0: 00 50 B4 02 8B 16 58 00 - B1 06 D2 E6 0A 36 5A 00 .P....X......6Z.
000000E0: 8B CA 86 E9 8A 36 25 00 - B2 80 CD 13 58 72 2A 01 .....6%.....Xr*.
000000F0: 06 54 00 83 16 56 00 00 - 29 06 5B 00 76 0B C1 E0 .T...V..).[.v...
00000100: 05 8C C2 03 D0 8E C2 EB - 8A 07 5A 59 5B 58 C3 BE ..........ZY[X..
00000110: 59 01 EB 08 BE E3 01 EB - 03 BE 39 01 E8 09 00 BE Y.........9.....
00000120: AD 01 E8 03 00 FB EB FE - AC 3C 00 74 09 B4 0E BB .........<.t....
00000130: 07 00 CD 10 EB F2 C3 1D - 00 41 20 64 69 73 6B 20 .........A disk
00000140: 72 65 61 64 20 65 72 72 - 6F 72 20 6F 63 63 75 72 read error occur
00000150: 72 65 64 2E 0D 0A 00 29 - 00 41 20 6B 65 72 6E 65 red....).A kerne
00000160: 6C 20 66 69 6C 65 20 69 - 73 20 6D 69 73 73 69 6E l file is missin
00000170: 67 20 66 72 6F 6D 20 74 - 68 65 20 64 69 73 6B 2E g from the disk.
00000180: 0D 0A 00 25 00 41 20 6B - 65 72 6E 65 6C 20 66 69 ...%.A kernel fi
00000190: 6C 65 20 69 73 20 74 6F - 6F 20 64 69 73 63 6F 6E le is too discon
000001A0: 74 69 67 75 6F 75 73 2E - 0D 0A 00 33 00 49 6E 73 tiguous....3.Ins
000001B0: 65 72 74 20 61 20 73 79 - 73 74 65 6D 20 64 69 73 ert a system dis
000001C0: 6B 65 74 74 65 20 61 6E - 64 20 72 65 73 74 61 72 kette and restar
000001D0: 74 0D 0A 74 68 65 20 73 - 79 73 74 65 6D 2E 0D 0A t..the system...
000001E0: 00 17 00 5C 4E 54 4C 44 - 52 20 69 73 20 63 6F 6D ...\NTLDR is com
000001F0: 70 72 65 73 73 65 64 2E - 0D 0A 00 00 00 00 55 AA pressed.......U.
Figure 17.13 Partition Boot Sector for a NTFS volume on an x86-based computer
The next table describes the fields for the BIOS Parameter Block and the Extended BIOS Parameter Block. The fields starting at 0x0B, 0x0D, 0x15, 0x18, 0x1A, and 0x1C are the same as the corresponding fields for FAT volumes, as described in Table 17.5.
Table 17.7 BIOS Parameter Block and Extended BIOS Parameter Block Fields for NTFS volumes
Byte Offset |
|
|
| |
0x0B | WORD | 0x0002 | Bytes per Sector. | |
0x0D | BYTE | 0x01 | Sectors per Cluster. | |
0x0E | WORD | 0x0000 | Reserved sectors. | |
0x10 | BYTE | 0x00 | Always 0. | |
0x11 | WORD | 0x0000 | Always 0. | |
0x13 | WORD | 0x0000 | Not used by NTFS. | |
0x15 | BYTE | 0xF8 | Media Type. | |
0x16 | WORD | 0x0000 | Always 0. | |
0x18 | WORD | 0x3F00 | Sectors per Track. | |
0x1A | WORD | 0x1000 | Number of Heads. | |
0x1C | DWORD | 90 42 06 00 | Hidden Sectors. | |
0x20 | DWORD | 00 00 00 00 | Not used by NTFS. | |
0x24 | DWORD | 80 00 80 00 | Not used by NTFS. | |
0x28 | LONGLONG | A0 3E 06 00 00 00 00 00 | Total Sectors. | |
0x30 | LCN | 10 00 00 00 00 00 00 00 | Logical cluster number for $MFT. | |
0x38 | LCN | 51 1F 03 00 00 00 00 00 | Logical cluster number for $MFTMirr. | |
0x40 | DWORD | 02 00 00 00 | Clusters per file record segment. | |
0x44 | DWORD | 04 00 00 00 | Clusters per index block. | |
0x48 | LONGLONG | 5B 1F DD 2C 4F DD 2C A2 | Volume Serial Number. | |
0x50 | DWORD | 00 00 00 00 | Checksum. | |
For information about the Master File Table and the $MFT and $MFTMirr files, see "Master File Table (MFT) and NTFS System Files," presented earlier in this chapter.