Partition Boot Sector

The Partition Boot Sector contains information that the file system uses to access the volume. On x86-based computers, the Master Boot Record use the Partition Boot Sector on the system partition to load the operating system kernel files, or in the case of Windows NT, the boot loader.

The Windows NT Partition Boot Sector consists of:

The BIOS Parameter Block (bytes 11 through 35 of the Partition Boot Sector) describes physical parameters of the volume. The extended BIOS Parameter Block begins immediately after the BIOS Parameter Block. The length of this structure is different for FAT and NTFS volumes. The information in the BIOS Parameter Block and the extended BIOS Parameter Block is used by disk device drivers to read and configure volumes.

The Partition Boot Sector is the first 512-byte sector at the beginning of the volume. The sector always ends with 0x55AA, which is a sector signature word that marks the end of the sector.

FAT Partition Boot Sector

Table 17.4 describes the fields in the Partition Boot Sector for a volume formatted with the FAT file system. The sample values are the data in the corresponding fields in the hex dump in Figure 17.12, presented later in this section.

Table 17.4 Partition Boot Sector for FAT volumes

Byte Offset (in hex)

Field Length

Sample Value

Meaning

00

3 bytes

EB 3C 90

Jump instruction

03

8 bytes

MSDOS5.0

OEM Name in text

0B

25 bytes

BIOS Parameter Block

24

26 bytes

Extended BIOS Parameter Block

3E

448 bytes

Bootstrap code

1FE

2 bytes

0x55AA

End of sector marker


The following figure is a hex printout of the Partition Boot Sector for a FAT volume. The printout is formatted in three sections:


Physical Sector: Cyl 0, Side 1, Sector 1     
00000000: EB 3C 90 4D 53 44 4F 53  - 35 2E 30                  <.MS-DOS5.0

                                              00 02 08 01 00              .....
00000010: 02 00 02 00 00 F8 C9 00  - 3F 00 10 00 3F 00 00 00   ........?...?...
00000020: 51 42 06 00 80 00 29 CE  - 13 46 30 4E 4F 20 4E 41   QB....)..F0NO NA
00000030: 4D 45 20 20 20 20 46 41  - 54 31 36 20 20 20         ME    FAT16   

                                                       33 C0                 3.
00000040: 8E D0 BC 00 7C 68 C0 07  - 1F A0 10 00 F7 26 16 00   ....|h......&..
00000050: 03 06 0E 00 50 91 B8 20  - 00 F7 26 11 00 8B 1E 0B   ....P.. ..&.....
00000060: 00 03 C3 48 F7 F3 03 C8  - 89 0E 08 02 68 00 10 07   ...H........h...
00000070: 33 DB 8F 06 13 02 89 1E  - 15 02 0E E8 90 00 72 57   3.............rW
00000080: 33 DB 8B 0E 11 00 8B FB  - 51 B9 0B 00 BE DC 01 F3   3.......Q.......
00000090: A6 59 74 05 83 C3 20 E2  - ED E3 37 26 8B 57 1A 52   .Yt... ...7&.W.R
000000A0: B8 01 00 68 00 20 07 33  - DB 0E E8 48 00 72 28 5B   ...h. .3...H.r([
000000B0: 8D 36 0B 00 8D 3E 0B 02  - 1E 8F 45 02 C7 05 F5 00   .6...>....E.....
000000C0: 1E 8F 45 06 C7 45 04 0E  - 01 8A 16 24 00 EA 03 00   ..E..E.....$....
000000D0: 00 20 BE 86 01 EB 03 BE  - A2 01 E8 09 00 BE C1 01   . ..............
000000E0: E8 03 00 FB EB FE AC 0A  - C0 74 09 B4 0E BB 07 00   .........t......
000000F0: CD 10 EB F2 C3 50 4A 4A  - A0 0D 00 32 E4 F7 E2 03   .....PJJ...2....
00000100: 06 08 02 83 D2 00 A3 13  - 02 89 16 15 02 58 A2 07   .............X..
00000110: 02 A1 13 02 8B 16 15 02  - 03 06 1C 00 13 16 1E 00   ................
00000120: F7 36 18 00 FE C2 88 16  - 06 02 33 D2 F7 36 1A 00   .6........3..6..
00000130: 88 16 25 00 A3 04 02 A1  - 18 00 2A 06 06 02 40 3A   ..%.......*...@:
00000140: 06 07 02 76 05 A0 07 02  - 32 E4 50 B4 02 8B 0E 04   ...v....2.P.....
00000150: 02 C0 E5 06 0A 2E 06 02  - 86 E9 8B 16 24 00 CD 13   ............$...
00000160: 0F 83 05 00 83 C4 02 F9  - CB 58 28 06 07 02 76 11   .........X(...v.
00000170: 01 06 13 02 83 16 15 02  - 00 F7 26 0B 00 03 D8 EB   ..........&.....
00000180: 90 A2 07 02 F8 CB 42 4F  - 4F 54 3A 20 43 6F 75 6C   ......BOOT: Coul
00000190: 64 6E 27 74 20 66 69 6E  - 64 20 4E 54 4C 44 52 0D   dn't find NTLDR.
000001A0: 0A 00 42 4F 4F 54 3A 20  - 49 2F 4F 20 65 72 72 6F   ..BOOT: I/O erro
000001B0: 72 20 72 65 61 64 69 6E  - 67 20 64 69 73 6B 0D 0A   r reading disk..
000001C0: 00 50 6C 65 61 73 65 20  - 69 6E 73 65 72 74 20 61   .Please insert a
000001D0: 6E 6F 74 68 65 72 20 64  - 69 73 6B 00 4E 54 4C 44   nother disk.NTLD
000001E0: 52 20 20 20 20 20 20 00  - 00 00 00 00 00 00 00 00   R      .........
000001F0: 00 00 00 00 00 00 00 00  - 00 00 00 00 00 00 55 AA   ..............U.

Figure 17.12 Partition Boot Sector for a FAT volume on x86-based computer

Table 17.5 shows the layout of the BIOS Parameter Block and the extended BIOS Parameter Block. The sample values correspond to data in Figure17.10.

Table 17.5 BIOS Parameter Block and Extended BIOS Parameter Block Fields for FAT volumes

Byte Offset

Field Length


Value


Meaning

0x0B

WORD

0x0002

Bytes per Sector. The size of a hardware sector. For most disks in use in the United States, the value of this field is 512.

0x0D

BYTE

0x08

Sectors Per Cluster. The number of sectors in a cluster. The default cluster size for a volume depends on the volume size and the file system.

0x0E

WORD

0x0100

Reserved Sectors. The number of sectors from the Partition Boot Sector to the start of the first file allocation table, including the Partition Boot Sector. The minimum value is 1. If the value is greater than 1, it means that the bootstrap code is too long to fit completely in the Partition Boot Sector.

0x10

BYTE

0x02

Number of file allocation tables (FATs). The number of copies of the file allocation table on the volume. Typically, the value of this field is 2.

0x11

WORD

0x0002

Root Entries. The total number of file name entries that can be stored in the root folder of the volume. One entry is always used as a Volume Label. Files with long filenames use up multiple entries per file. Therefore, the largest number of files in the root folder is typically 511, but you will run out of entries sooner if you use long filenames.

0x13

WORD

0x0000

Small Sectors. The number of sectors on the volume if the number fits in 16 bits (65535). For volumes larger than 65536 sectors, this field has a value of 0 and the Large Sectors field is used instead.

0x15

BYTE

0xF8

Media Type. Provides information about the media being used. A value of 0xF8 indicates a hard disk.

0x16

WORD

0xC900

Sectors per file allocation table (FAT). Number of sectors occupied by each of the file allocation tables on the volume. By using this information, together with the Number of FATs and Reserved Sectors, you can compute where the root folder begins. By using the number of entries in the root folder, you can also compute where the user data area of the volume begins.

0x18

WORD

0x3F00

Sectors per Track. The apparent disk geometry in use when the disk was low-level formatted.

0x1A

WORD

0x1000

Number of Heads. The apparent disk geometry in use when the disk was low-level formatted.

0x1C

DWORD

3F 00 00 00

Hidden Sectors. Same as the Relative Sector field in the Partition Table.

0x20

DWORD

51 42 06 00

Large Sectors. If the Small Sectors field is zero, this field contains the total number of sectors in the volume. If Small Sectors is nonzero, this field contains zero..

0x24

BYTE

0x80

Physical Disk Number. This is related to the BIOS physical disk number. Floppy drives are numbered starting with 0x00 for the A disk. Physical hard disks are numbered starting with 0x80. The value is typically 0x80 for hard disks, regardless of how many physical disk drives exist, because the value is only relevant if the device is the startup disk.

0x25

BYTE

0x00

Current Head. Not used by the FAT file system. Therefore, Windows NT uses this field to store two flags:

The low order bit is a dirty flag, used to indicate that Windows NT should run the Chkdsk program against the volume when it starts.

The second lowest bit indicates that a surface scan should also be run.

0x26

BYTE

0x29

Signature. Must be either 0x28 or 0x29 in order to be recognized by Windows NT.

0x27

4 bytes

CE 13 46 30

Volume Serial Number. A unique number that is created when you format the volume.

0x2B

11 bytes

NO NAME

Volume Label. This field was used to store the volume label, but the volume label is now stored as special file in the root directory.

0x36

8 bytes

FAT16

System ID. Either FAT12 or FAT16, depending on the format of the disk.


For the Media Descriptor field, the following table lists some of the recognized media descriptor values and their associated media. A media descriptor value can be associated with more than one disk capacity.

Value

Capacity

Media Size and Type

F0

2.88 MB

3.5-inch, 2-sided, 36-sector

F0

1.44 MB

3.5-inch, 2-sided, 18-sector

F9

720 KB

3.5-inch, 2-sided, 9-sector

F9

1.2 MB

5.25-inch, 2-sided, 15-sector

FD

360 KB

5.25-inch, 2-sided, 9-sector

FF

320 KB

5.25-inch, 2-sided, 8-sector

FC

180 KB

5.25-inch, 1-sided, 9-sector

FE

160 KB

5.25-inch, 1-sided, 8-sector

F8

N/A

Fixed disk


NTFS Partition Boot Sector

Table 17.6 describes the fields in the Partition Boot Sector for a volume formatted with the NTFS file system. The sample values are the data in the corresponding fields in the hex dump in Figure 17.13, presented later in this section.

Table 17.6 Partition Boot Sector for NTFS volume

Byte Offset (in hex)


Field Length


Sample Value


Meaning

00

3 bytes

EB 5B 00

Jump instruction

03

8 bytes

NTFS

OEM Identifier

0B

25 bytes

BIOS Parameter Block

24

48 bytes

Extended BIOS Parameter Block

54

426 bytes

Bootstrap code

1FE

WORD

0x55AA

End of sector marker


Note

The bootstrap code for an NTFS volume is longer than the 426 bytes shown here. When you format an NTFS volume, the format program allocates the first 16 sectors for the Partition Boot Sector and the bootstrap code.

The extra data fields after the BIOS Parameter Block form an extended BIOS Parameter Block for NTFS. The data in these fields enable the boot loader to find the Master File Table (MFT) during the startup process. In the NTFS file system, the MFT is not located in a predefined sector as is the case for the file allocation table on a FAT volume. Thus, the MFT can be moved if there is a bad sector in its normal location. However, if these data are corrupt, the MFT cannot be located and Windows NT assumes the volume has not been formatted.

The following figure is a hex dump of the Partition Boot Sector for an NTFS volume (formatted when running Windows NT 4.0). The printout is formatted in three sections:


                Physical Sector: Cyl 407, Side 0, Sector 1     
                00000000: EB 5B 90 4E 54 46 53 20  - 20 20 20                  .[.NTFS    

                                              00 02 01 00 00              .....
00000010: 00 00 00 00 00 F8 00 00  - 3F 00 10 00 90 42 06 00   ........?....B..
00000020: 00 00 00 00 80 00 80 00  - A0 3E 06 00 00 00 00 00   .........>......
00000030: 10 00 00 00 00 00 00 00  - 51 1F 03 00 00 00 00 00   ........Q......
00000040: 02 00 00 00 04 00 00 00  - 5B 1F DD 2C 4F DD 2C A2   ........[.,O.,.
00000050: 00 00 00 00                                          ....

                      00 00 00 00  - 00 00 00 00 00 FA 33 C0       ..........3.
00000060: 8E D0 BC 00 7C FB B8 C0  - 07 8E D8 C7 06 54 00 00   ....|........T..
00000070: 00 C7 06 56 00 00 00 C7  - 06 5B 00 10 00 B8 00 0D   ...V.....[......
00000080: 8E C0 2B DB E8 07 00 68  - 00 0D 68 56 02 CB 50 53   ..+....h..hV..PS
00000090: 51 52 06 66 A1 54 00 66  - 03 06 1C 00 66 33 D2 66   QR.f.T.f....f3.f
000000A0: 0F B7 0E 18 00 66 F7 F1  - FE C2 88 16 5A 00 66 8B   .....f......Z.f.
000000B0: D0 66 C1 EA 10 F7 36 1A  - 00 88 16 25 00 A3 58 00   .f....6....%..X.
000000C0: A1 18 00 2A 06 5A 00 40  - 3B 06 5B 00 76 03 A1 5B   ...*.Z.@;.[.v..[
000000D0: 00 50 B4 02 8B 16 58 00  - B1 06 D2 E6 0A 36 5A 00   .P....X......6Z.
000000E0: 8B CA 86 E9 8A 36 25 00  - B2 80 CD 13 58 72 2A 01   .....6%.....Xr*.
000000F0: 06 54 00 83 16 56 00 00  - 29 06 5B 00 76 0B C1 E0   .T...V..).[.v...
00000100: 05 8C C2 03 D0 8E C2 EB  - 8A 07 5A 59 5B 58 C3 BE   ..........ZY[X..
00000110: 59 01 EB 08 BE E3 01 EB  - 03 BE 39 01 E8 09 00 BE   Y.........9.....
00000120: AD 01 E8 03 00 FB EB FE  - AC 3C 00 74 09 B4 0E BB   .........<.t....
00000130: 07 00 CD 10 EB F2 C3 1D  - 00 41 20 64 69 73 6B 20   .........A disk 
00000140: 72 65 61 64 20 65 72 72  - 6F 72 20 6F 63 63 75 72   read error occur
00000150: 72 65 64 2E 0D 0A 00 29  - 00 41 20 6B 65 72 6E 65   red....).A kerne
00000160: 6C 20 66 69 6C 65 20 69  - 73 20 6D 69 73 73 69 6E   l file is missin
00000170: 67 20 66 72 6F 6D 20 74  - 68 65 20 64 69 73 6B 2E   g from the disk.
00000180: 0D 0A 00 25 00 41 20 6B  - 65 72 6E 65 6C 20 66 69   ...%.A kernel fi
00000190: 6C 65 20 69 73 20 74 6F  - 6F 20 64 69 73 63 6F 6E   le is too discon
000001A0: 74 69 67 75 6F 75 73 2E  - 0D 0A 00 33 00 49 6E 73   tiguous....3.Ins
000001B0: 65 72 74 20 61 20 73 79  - 73 74 65 6D 20 64 69 73   ert a system dis
000001C0: 6B 65 74 74 65 20 61 6E  - 64 20 72 65 73 74 61 72   kette and restar
000001D0: 74 0D 0A 74 68 65 20 73  - 79 73 74 65 6D 2E 0D 0A   t..the system...
000001E0: 00 17 00 5C 4E 54 4C 44  - 52 20 69 73 20 63 6F 6D   ...\NTLDR is com
000001F0: 70 72 65 73 73 65 64 2E  - 0D 0A 00 00 00 00 55 AA   pressed.......U.

Figure 17.13 Partition Boot Sector for a NTFS volume on an x86-based computer

The next table describes the fields for the BIOS Parameter Block and the Extended BIOS Parameter Block. The fields starting at 0x0B, 0x0D, 0x15, 0x18, 0x1A, and 0x1C are the same as the corresponding fields for FAT volumes, as described in Table 17.5.

Table 17.7 BIOS Parameter Block and Extended BIOS Parameter Block Fields for NTFS volumes

Byte Offset


Field Length


Sample Value


Meaning

0x0B

WORD

0x0002

Bytes per Sector.

0x0D

BYTE

0x01

Sectors per Cluster.

0x0E

WORD

0x0000

Reserved sectors.

0x10

BYTE

0x00

Always 0.

0x11

WORD

0x0000

Always 0.

0x13

WORD

0x0000

Not used by NTFS.

0x15

BYTE

0xF8

Media Type.

0x16

WORD

0x0000

Always 0.

0x18

WORD

0x3F00

Sectors per Track.

0x1A

WORD

0x1000

Number of Heads.

0x1C

DWORD

90 42 06 00

Hidden Sectors.

0x20

DWORD

00 00 00 00

Not used by NTFS.

0x24

DWORD

80 00 80 00

Not used by NTFS.

0x28

LONGLONG

A0 3E 06 00 00 00 00 00

Total Sectors.

0x30

LCN

10 00 00 00 00 00 00 00

Logical cluster number for $MFT.

0x38

LCN

51 1F 03 00 00 00 00 00

Logical cluster number for $MFTMirr.

0x40

DWORD

02 00 00 00

Clusters per file record segment.

0x44

DWORD

04 00 00 00

Clusters per index block.

0x48

LONGLONG

5B 1F DD 2C 4F DD 2C A2

Volume Serial Number.

0x50

DWORD

00 00 00 00

Checksum.


For information about the Master File Table and the $MFT and $MFTMirr files, see "Master File Table (MFT) and NTFS System Files," presented earlier in this chapter.