Partition Boot Sector

The Partition Boot Sector contains information that the file system uses to access the volume. On x86-based computers, the Master Boot Record use the Partition Boot Sector on the system partition to load the operating system Kernel files, or in the case of Windows NT, the boot loader.

The Windows NT Partition Boot Sector consists of:

A jump instruction.
The OEM name and version.
A data structure called the BIOS Parameter Block.
Another data structure called the extended BIOS Parameter Block.
The bootstrap code.

The BIOS Parameter Block (bytes 11 through 35 of the Partition Boot Sector) describes physical parameters of the volume. The extended BIOS Parameter Block begins immediately after the BIOS Parameter Block. The length of this structure is different for FAT and NTFS volumes. The information in the BIOS Parameter Block and the extended BIOS Parameter Block is used by disk device drivers to read and configure volumes.

The Partition Boot Sector is the first 512-byte sector at the beginning of the volume. The sector always ends with 0x55AA, which is a sector signature word that marks the end of the sector.

FAT Partition Boot Sector

Table 3.2 describes the fields in the Partition Boot Sector for a volume formatted with the FAT file system. The sample values are the data in the corresponding fields in the hex dump in Figure 3.7, presented later in this section.

Table 3.2 Partition Boot Sector for FAT volumes


Byte Offset (in hex)	Field Length	Sample Value	Meaning

00	3 bytes	EB 3C 90	Jump instruction
03	8 bytes	MSDOS5.0	OEM Name in text
0B	25 bytes		BIOS Parameter Block
24	26 bytes		Extended BIOS Parameter Block
3E	448 bytes		Bootstrap code
1FE	2 bytes	0x55AA	End of sector marker

The following figure is a hex printout of the Partition Boot Sector for a FAT volume. The printout is formatted in three sections:

Bytes 0 - 0x0A are the jump instruction and the OEM name.
Bytes 0x0B - 0x3D are the BIOS Parameter Block and the Extended BIOS Parameter Block.
The rest of the printout is the bootstrap code and the end of sector marker.

Physical Sector: Cyl 0, Side 1, Sector 1 00000000: EB 3C 90 4D 53 44 4F 53 - 35 2E 30 <.MS-DOS5.0 00 02 08 01 00 ..... 00000010: 02 00 02 00 00 F8 C9 00 - 3F 00 10 00 3F 00 00 00 ........?...?... 00000020: 51 42 06 00 80 00 29 CE - 13 46 30 4E 4F 20 4E 41 QB....)..F0NO NA 00000030: 4D 45 20 20 20 20 46 41 - 54 31 36 20 20 20 ME FAT16 33 C0 3. 00000040: 8E D0 BC 00 7C 68 C0 07 - 1F A0 10 00 F7 26 16 00 ....|h......&.. 00000050: 03 06 0E 00 50 91 B8 20 - 00 F7 26 11 00 8B 1E 0B ....P.. ..&..... 00000060: 00 03 C3 48 F7 F3 03 C8 - 89 0E 08 02 68 00 10 07 ...H........h... 00000070: 33 DB 8F 06 13 02 89 1E - 15 02 0E E8 90 00 72 57 3.............rW 00000080: 33 DB 8B 0E 11 00 8B FB - 51 B9 0B 00 BE DC 01 F3 3.......Q....... 00000090: A6 59 74 05 83 C3 20 E2 - ED E3 37 26 8B 57 1A 52 .Yt... ...7&.W.R 000000A0: B8 01 00 68 00 20 07 33 - DB 0E E8 48 00 72 28 5B ...h. .3...H.r([ 000000B0: 8D 36 0B 00 8D 3E 0B 02 - 1E 8F 45 02 C7 05 F5 00 .6...>....E..... 000000C0: 1E 8F 45 06 C7 45 04 0E - 01 8A 16 24 00 EA 03 00 ..E..E.....$.... 000000D0: 00 20 BE 86 01 EB 03 BE - A2 01 E8 09 00 BE C1 01 . .............. 000000E0: E8 03 00 FB EB FE AC 0A - C0 74 09 B4 0E BB 07 00 .........t...... 000000F0: CD 10 EB F2 C3 50 4A 4A - A0 0D 00 32 E4 F7 E2 03 .....PJJ...2.... 00000100: 06 08 02 83 D2 00 A3 13 - 02 89 16 15 02 58 A2 07 .............X.. 00000110: 02 A1 13 02 8B 16 15 02 - 03 06 1C 00 13 16 1E 00 ................ 00000120: F7 36 18 00 FE C2 88 16 - 06 02 33 D2 F7 36 1A 00 .6........3..6.. 00000130: 88 16 25 00 A3 04 02 A1 - 18 00 2A 06 06 02 40 3A ..%.......*...@: 00000140: 06 07 02 76 05 A0 07 02 - 32 E4 50 B4 02 8B 0E 04 ...v....2.P..... 00000150: 02 C0 E5 06 0A 2E 06 02 - 86 E9 8B 16 24 00 CD 13 ............$... 00000160: 0F 83 05 00 83 C4 02 F9 - CB 58 28 06 07 02 76 11 .........X(...v. 00000170: 01 06 13 02 83 16 15 02 - 00 F7 26 0B 00 03 D8 EB ..........&..... 00000180: 90 A2 07 02 F8 CB 42 4F - 4F 54 3A 20 43 6F 75 6C ......BOOT: Coul 00000190: 64 6E 27 74 20 66 69 6E - 64 20 4E 54 4C 44 52 0D dn't find NTLDR. 000001A0: 0A 00 42 4F 4F 54 3A 20 - 49 2F 4F 20 65 72 72 6F ..BOOT: I/O erro 000001B0: 72 20 72 65 61 64 69 6E - 67 20 64 69 73 6B 0D 0A r reading disk.. 000001C0: 00 50 6C 65 61 73 65 20 - 69 6E 73 65 72 74 20 61 .Please insert a 000001D0: 6E 6F 74 68 65 72 20 64 - 69 73 6B 00 4E 54 4C 44 nother disk.NTLD 000001E0: 52 20 20 20 20 20 20 00 - 00 00 00 00 00 00 00 00 R ......... 000001F0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 55 AA ..............U.

Figure 3.7. Partition Boot Sector for a FAT volume on x86-based computer

Table 3.3 shows the layout of the BIOS Parameter Block and the extended BIOS Parameter Block. The sample values correspond to the data in Figure 3.7.

Table 3.3 BIOS Parameter Block and Extended BIOS Parameter Block Fields for FAT volumes


Byte Offset	Field Length	Value	Meaning

0x0B	WORD	0x0002	Bytes per Sector. The size of a hardware sector. For most disks in use in the United States, the value of this field is 512.
0x0D	BYTE	0x08	Sectors Per Cluster. The number of sectors in a cluster. The default cluster size for a volume depends on the volume size and the file system.
0x0E	WORD	0x0100	Reserved Sectors. The number of sectors from the Partition Boot Sector to the start of the first file allocation table, including the Partition Boot Sector. The minimum value is 1. If the value is greater than 1, it means that the bootstrap code is too long to fit completely in the Partition Boot Sector.
0x10	BYTE	0x02	Number of file allocation tables (FATs). The number of copies of the file allocation table on the volume. Typically, the value of this field is 2.
0x11	WORD	0x0002	Root Entries. The total number of file name entries that can be stored in the root folder of the volume.
0x13	WORD	0x0000	Small Sectors. The number of sectors on the volume if the number fits in 16 bits (65535). For volumes larger than 65536 sectors, this field has a value of 0 and the Large Sectors field is used instead.
0x15	BYTE	0xF8	Media Type. Provides information about the media being used. A value of 0xF8 indicates a hard disk.
0x16	WORD	0xC900	Sectors per file allocation table (FAT). Number of sectors occupied by each of the file allocation tables on the volume.
0x18	WORD	0x3F00	Sectors per Track. The apparent disk geometry in use when the disk was formatted.
0x1A	WORD	0x1000	Number of Heads. The apparent disk geometry in use when the disk was formatted.
0x1C	DWORD	3F 00 00 00	Hidden Sectors. Same as the Relative Sector field in the Partition Table.
0x20	DWORD	51 42 06 00	Large Sectors. If the Small Sectors field is zero, this field contains the total number of sectors in the volume. If Small Sectors is nonzero, this field contains zero.
0x24	BYTE	0x80	Physical Disk Number. This is related to the BIOS physical disk number. Floppy drives are numbered starting with 0x00 for the A disk. Physical hard disks are numbered starting with 0x80. The value is typically 0x80 for hard disks, regardless of how many physical disk drives exist, because the value is only relevant if the device is the startup disk.
0x25	BYTE	0x00	Current Head. Not used by the FAT file system. Therefore, Windows NT uses this field to store two flags: · The low order bit is a dirty flag, used to indicate that Windows NT should run the Chkdsk program against the volume when it starts. · The second lowest bit indicates to that a surface scan should also be run.
0x26	BYTE	0x29	Signature. Must be either 0x28 or 0x29 in order to be recognized by Windows NT.
0x27	4 bytes	CE 13 46 30	Volume Serial Number. A unique number that is created when you format the volume.
0x2B	11 bytes	NO NAME	Volume Label. This field was used to store the volume label, but the volume label is now stored as special file in the root directory.
0x36	8 bytes	FAT16	System ID. Either FAT12 or FAT16, depending on the format of the disk.

NTFS Partition Boot Sector

Table 3.4 describes the fields in the Partition Boot Sector for a volume formatted with the NTFS file system. The sample values are the data in the corresponding fields in the hex dump in Figure 3.8, presented later in this section.

Table 3.4 Partition Boot Sector for NTFS volume


Byte Offset (in hex)	Field Length	Sample Value	Meaning

00	3 bytes	EB 5B 00	Jump instruction
03	8 bytes	NTFS	OEM Identifier
0B	25 bytes		BIOS Parameter Block
24	48 bytes		Extended BIOS Parameter Block
54	426 bytes		Bootstrap code
1FE	WORD	0x55AA	End of sector marker

Note

The bootstrap code for an NTFS volume is longer than the 426 bytes shown here. When you format an NTFS volume, the format program allocates the first 16 sectors for the Partition Boot Sector and the bootstrap code.

The extra data fields after the BIOS Parameter Block form an extended BIOS Parameter Block for NTFS. The data in these fields enable the boot loader to find the Master File Table (MFT) during the startup process. In the NTFS file system, the MFT is not located in a predefined sector as is the case for the file allocation table on a FAT volume. Thus, the MFT can be moved if there is a bad sector in its normal location. However, if these data are corrupt, the MFT cannot be located and Windows NT assumes the volume has not been formatted.

Note

The MFT contains information about all of the files on an NTFS volume. See Chapter 17, "Disk and File System Basics," in the Windows NT Workstation Resource Guide for details about the MFT.

The following figure is a hex dump of the Partition Boot Sector for an NTFS volume (formatted when running Windows NT 4.0). The printout is formatted in three sections:

Bytes 0 - 0x0A are the jump instruction and the OEM name.
Bytes 0x0B - 0x53 are the BIOS Parameter Block and the Extended BIOS Parameter Block.
The rest of the printout is the bootstrap code and the end of sector marker.

Physical Sector: Cyl 407, Side 0, Sector 1 00000000: EB 5B 90 4E 54 46 53 20 - 20 20 20 .[.NTFS 00 02 01 00 00 ..... 00000010: 00 00 00 00 00 F8 00 00 - 3F 00 10 00 90 42 06 00 ........?....B.. 00000020: 00 00 00 00 80 00 80 00 - A0 3E 06 00 00 00 00 00 .........>...... 00000030: 10 00 00 00 00 00 00 00 - 51 1F 03 00 00 00 00 00 ........Q...... 00000040: 02 00 00 00 04 00 00 00 - 5B 1F DD 2C 4F DD 2C A2 ........[.,O.,. 00000050: 00 00 00 00 .... 00 00 00 00 - 00 00 00 00 00 FA 33 C0 ..........3. 00000060: 8E D0 BC 00 7C FB B8 C0 - 07 8E D8 C7 06 54 00 00 ....|........T.. 00000070: 00 C7 06 56 00 00 00 C7 - 06 5B 00 10 00 B8 00 0D ...V.....[...... 00000080: 8E C0 2B DB E8 07 00 68 - 00 0D 68 56 02 CB 50 53 ..+....h..hV..PS 00000090: 51 52 06 66 A1 54 00 66 - 03 06 1C 00 66 33 D2 66 QR.f.T.f....f3.f 000000A0: 0F B7 0E 18 00 66 F7 F1 - FE C2 88 16 5A 00 66 8B .....f......Z.f. 000000B0: D0 66 C1 EA 10 F7 36 1A - 00 88 16 25 00 A3 58 00 .f....6....%..X. 000000C0: A1 18 00 2A 06 5A 00 40 - 3B 06 5B 00 76 03 A1 5B ...*.Z.@;.[.v..[ 000000D0: 00 50 B4 02 8B 16 58 00 - B1 06 D2 E6 0A 36 5A 00 .P....X......6Z. 000000E0: 8B CA 86 E9 8A 36 25 00 - B2 80 CD 13 58 72 2A 01 .....6%.....Xr*. 000000F0: 06 54 00 83 16 56 00 00 - 29 06 5B 00 76 0B C1 E0 .T...V..).[.v... 00000100: 05 8C C2 03 D0 8E C2 EB - 8A 07 5A 59 5B 58 C3 BE ..........ZY[X.. 00000110: 59 01 EB 08 BE E3 01 EB - 03 BE 39 01 E8 09 00 BE Y.........9..... 00000120: AD 01 E8 03 00 FB EB FE - AC 3C 00 74 09 B4 0E BB .........<.t.... 00000130: 07 00 CD 10 EB F2 C3 1D - 00 41 20 64 69 73 6B 20 .........A disk 00000140: 72 65 61 64 20 65 72 72 - 6F 72 20 6F 63 63 75 72 read error occur 00000150: 72 65 64 2E 0D 0A 00 29 - 00 41 20 6B 65 72 6E 65 red....).A kerne 00000160: 6C 20 66 69 6C 65 20 69 - 73 20 6D 69 73 73 69 6E l file is missin 00000170: 67 20 66 72 6F 6D 20 74 - 68 65 20 64 69 73 6B 2E g from the disk. 00000180: 0D 0A 00 25 00 41 20 6B - 65 72 6E 65 6C 20 66 69 ...%.A kernel fi 00000190: 6C 65 20 69 73 20 74 6F - 6F 20 64 69 73 63 6F 6E le is too discon 000001A0: 74 69 67 75 6F 75 73 2E - 0D 0A 00 33 00 49 6E 73 tiguous....3.Ins 000001B0: 65 72 74 20 61 20 73 79 - 73 74 65 6D 20 64 69 73 ert a system dis 000001C0: 6B 65 74 74 65 20 61 6E - 64 20 72 65 73 74 61 72 kette and restar 000001D0: 74 0D 0A 74 68 65 20 73 - 79 73 74 65 6D 2E 0D 0A t..the system... 000001E0: 00 17 00 5C 4E 54 4C 44 - 52 20 69 73 20 63 6F 6D ...\NTLDR is com 000001F0: 70 72 65 73 73 65 64 2E - 0D 0A 00 00 00 00 55 AA pressed.......U.

Figure 3.8. Partition Boot Sector for a NTFS volume on an x86-based computer

The next table describes the fields for the BIOS Parameter Block and the Extended BIOS Parameter Block. The fields starting at 0x0B, 0x0D, 0x15, 0x18, 0x1A, and 0x1C are the same as the corresponding fields for FAT volumes, as described in Table 3.3.

Table 3.5 BIOS Parameter Block and Extended BIOS Parameter Block Fields for NTFS volumes


Byte Offset	Field Length	Sample Value	Meaning
0x0B	WORD	0x0002	Bytes per Sector.
0x0D	BYTE	0x01	Sectors per Cluster.
0x0E	WORD	0x0000	Reserved sectors.
0x10	BYTE	0x00	Always 0.
0x11	WORD	0x0000	Always 0.
0x13	WORD	0x0000	Not used by NTFS.
0x15	BYTE	0xF8	Media Type.
0x16	WORD	0x0000	Always 0.
0x18	WORD	0x3F00	Sectors per Track.
0x1A	WORD	0x1000	Number of Heads.
0x1C	DWORD	90 42 06 00	Hidden Sectors.
0x20	DWORD	00 00 00 00	Not used by NTFS.
0x24	DWORD	80 00 80 00	Not used by NTFS.
0x28	LONGLONG	A0 3E 06 00 00 00 00 00	Total Sectors.
0x30	LCN	10 00 00 00 00 00 00 00	Logical cluster number for $MFT.
0x38	LCN	51 1F 03 00 00 00 00 00	Logical cluster number for $MFTMirr.
0x40	DWORD	02 00 00 00	Clusters per file record segment.
0x44	DWORD	04 00 00 00	Clusters per index block.
0x48	LONGLONG	5B 1F DD 2C 4F DD 2C A2	Volume Serial Number.
0x50	DWORD	00 00 00 00	Checksum.

For information about the Master File Table and the $MFT and $MFTMirr files, see Chapter 17, "Disk and File System Basics," in the Windows NT Workstation Resource Guide.