Sponsoring website: Emergency Boot CD



An Examination of the
NTFS Volume Boot Record

Of Microsoft® Windows™ 2000
(NT5.0) and Windows™ XP (NT5.1)
[ It's also found in SPCMDCON.SYS and
other System files; see Introduction below. ]


Web Presentation and Text are Copyright©2004, 2007, 2009 and
2012 by Daniel B. Sedory
NOT to be reproduced in any form without Permission of the Author !

 

Note: It's always best to confirm whatever you read on the Net with your own experiments. During the long span of Windows XP, Microsoft changed the code for these Boot Record sectors once before:
http://support.microsoft.com/kb/320397 (Windows may not start and you may receive an "NTLDR is missing" error message if Windows is not up-to-date and there are too many files in the root folder) in which you'll find out why Microsoft had to change the Boot Record code for Windows 2000 with Service Pack 4 (SP4) and Windows XP with Service Pack 2 (SP2). Note: Installing Windows XP SP2 or Windows 2000 SP4, will not correct this issue on existing volumes. To update the boot code on existing volumes, you must either obtain and run the utility "bcupdate2.exe" (MD5 hash value is: "2e2ed06d9ae54c8d959a534a83284705") from Microsoft, or manually change the boot code using an updated copy. The service pack updates will only write the new boot code for new volumes; they cannot correct old volumes.

You can contact us here if you have a specific question about this page.





Introduction

The NTFS Boot Record really is only one sector long!

We carried out an experiment which proves that only the first sector of an NTFS partition is the NTFS Boot Record: In a disk editor under real DOS, every byte of the “Bootstrap Code” for a Win XP NTFS partition (on a second drive) was filled with zero bytes! Upon booting up our Master drive's Windows 2000 OS, we found that all the files in that Win XP partition could still be accessed (both read and write) and used without any problems. So, the "Bootstrap code" really is just that: It's only used to boot up any existing OS in that partition! Even though the phrase "Boot Record" isn't very descriptive for a sector that's only used to access files in the partition, there's an historical precedent for using it this way: The first sector of every floppy disk is also called a "Boot Record" even though it will never be bootable unless you add the correct system boot files to it! You can, of course, remove most of the boot code from either the NTFS or a floppy's Boot Record, since their BPBs are the only thing that an OS needs in order to access their files!! If you look for them, you'll eventually find many floppy disks with a "Boot Record" that contains only a BPB and a very short string of code that displays a message saying that you can not boot-up with that diskette if you try to boot your system with it!

NOTE: If you create a new NTFS partition with a Win 2000/XP OS, the "Bootstrap Code" will always be appended to the Boot Record; though it might be possible to change this 'boot code,' to make it only display a message saying that the partition isn't bootable, there's no practical reason for doing so, and it might lead to serious problems if you ever tried to install a Win2000/XP OS in that partition!



The NTFS Boot Record's “Backup Sector”

The Win 2000/XP OSs make a "backup" of each NTFS volume's Boot Record which they store in the very last sector of its partition!
[ Note: I said "partition" not volume. This is why an NTFS partition's Total Sectors count in the MBR/EBR's Partition Table is always 1 sector more than the "Total Sectors (in Volume)" count found in its Boot Record. Although the words partition (primary) and volume are often thought of as being synonymous (we may even use them as such here!), this shows they are not always the same. ]

Brian Carrier, the developer of The Sleuth Kit ( TSK) appeared to have discovered this for himself when writing about the 'backup copy' of the boot sector on page 220 of his work, File System Forensic Analysis (2005; Addison Wesley). But instead of stating as we did here, that the Volume is 1 sector less than the size of its Partition, it seems to us he mistakenly chalked this up to something he called 'the NTFS file system size' being smaller than the NTFS Volume: "My survey of Windows NT 4.0, 2000, and XP volumes had the backup copy in the last sector. I found that the total number of sectors in the file system was less than the total number of sectors in the volume, so the backup copy of the boot sector did not have to be allocated to a specific file." As usual, you must be careful when researching for technical facts; we cannot guarantee everything will always be correct at The Starman's Realm either.


 




The NTFS Bios Parameter Block



        0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F

 000B                                   00 02 08 00 00              .....
 0010  00 00 00 00 00 F8 00 00 3F 00 FF 00 3F 00 00 00   ........?...?...
 0020  00 00 00 00 80 00 80 00 AE 39 D7 00 00 00 00 00   .........9......
 0030  04 00 00 00 00 00 00 00 8D EF 00 00 00 00 00 00   ................
 0040  F6 00 00 00 01 00 00 00 FC 5D E1 A4 99 E1 A4 B4   .........]......
 0050  00 00 00 00                                       .....
Offset Length Hex
Numbers
Decimal
Equiv. or
Meaning
Description
0Bh Word 0200 512  Sector Size (in bytes)
Reference     " If maximum compatibility is desired, only the value 512 should be used. There is a lot of FAT code in the world that is basically "hard wired" to 512 bytes per sector and doesn’t bother to check this field to make sure it is 512. [So]...values [other than 512] are not recommended."
0Dh Byte 08 8  Sectors per Cluster; so
 Cluster size here = 4 KiB
Reference

" Number of sectors per allocation unit. This value must be a power of 2 that is greater than 0. Values of 1, 2, 4, 8 are quite common."
    [
I've seen a value of 4 ( for a Windows XP partition of less than 2GB ), but a value of 8 ( for Windows 2000 and XP ) is probably the most common. ]

0Eh Word 0000 0  Reserved Sectors; I've never seen anything but a zero here for NTFS (does your BPB have anything else here?).
After loading into Memory, this location becomes: 7C0Eh, and it's used to store how many sectors of the Boot Record are to be read into Memory; it begins with a value of 16 (decimal) and counts down to zero. (See line: 7C6C below.)
10h Byte 00 N/A  Must always be zero for NTFS volumes (originally the number of  FATs for a FAT partition).
11h 2 Bytes 0000 N/A  Must always be zero for NTFS volumes (originally the Max. Root Directory Entries under FAT12/16).
13h 2 Bytes 0000 N/A  Most often set to zero, but not used by NTFS (orig. used for the FAT12/16 small sectors count; must be zero for FAT32).
15h Byte F8 "Fixed Disk"    Media Descriptor ID.
( Win 2000/XP do not use it, but other code might so it's set to F8).
16h 2 Bytes 0000 N/A  Must be set to zero for NTFS volumes (originally for FAT12/16 "Sectors per FAT" value).
18h Word 003F 63  Sectors per Track
1Ah Word 00FF 255  Number of Heads (Sides)
1Ch Double Word 0000003F 63  Number of "Hidden
 Sectors" (Cyl=0 Head=0)
Under Vista and 7 00000800 2048   (Cyl=0 Head=20h Sect=21h)
Reference

   Note: Under Windows™ Vista and Windows™ 7, the number of "Hidden" or Reserved Sectors for the first partition has been increased to 2048 (0x800) rather than 63.

   " Count of hidden sectors preceding the partition that contains this [NTFS] volume. This field is generally only relevant for media visible on interrupt 0x13. This field should always be zero on media that are not partitioned. Exactly what value is appropriate is operating system specific."  [ Although I'm not exactly sure what all the implications are of this quote from Microsoft, I can tell you that this value is definitely used while reading the boot sectors into Memory! See line: 7CCF in the Subroutine below. This value is supposed to be the number of physical sectors on the disk preceding the first sector of this volume; it's obvious why the first entry in a disk's partition table has a 63 here, but it will also be a 63 for each Logical volume on a disk since each Logical volume in an Extended Partition is preceded by its own Extended MBR. So, this value varies only for an NTFS partition that is a 2nd, 3rd or 4th Primary Partition.
    Note: If you see a value of 29 (1D hex) in this field, it's most likely because the volume was created on a Dynamic Disk.]

Is it safe to change this value for booting a Windows OS? & Can Win 2000/XP boot from an Extended partition?

20h 4 Bytes 00000000 N/A  Most often set to zero, but not used by NTFS (originally used for the Total Number of Sectors in a FAT32 volume).
After loading into Memory ( and carrying out the instructions in the subroutine at offsets 7C7B and following ), offset 7C20h is used to store the Total Number of Sectors in the partition we're trying to boot; see line: 7CA5 for the reference.
24h 4 Bytes 80008000 First byte:
80h
is the drive number !
An NTFS OS always
fills these bytes with:
"80008000"
According to most documentation, this area is not supposed to be used by NTFS, but after examining the code in the Boot Record, it seems clear that the first byte of these four bytes is used  to set the drive number! (See offsets: 7C7B and 7CAF).
28h Long
Long
Word

(8 Bytes)
00000000
00D739AE
14,105,006
Total Sectors
( in the Volume )
Read following note!
  As we mentioned above, this value will always be 1 sector less than the total number
  of sectors in the volume's partition table entry, because an NTFS "Backup Sector"
  is not considered part of the NTFS Volume.
30h Long
Long
Word

(8 Bytes)
00000000
00000004
4 Starting Cluster Number for the $MFT File in this partition ( Logical Sector 32; if  the Sectors per Cluster value is an  8 ).
38h Long
Long
Word

(8 Bytes)
00000000
0000EF8D
61,325  Starting Cluster Number for the $MFTMirror File in this partition.
40h Signed
(+/-)
Byte
F6 -10 =>
1024 bytes
 Clusters (or bytes) per
 File Record Segment
 (FRS).

The Number of Clusters for each MFT record, which can be a negative number when the cluster size (8 sectors in this case) is larger than the MFT File Record size! The value F6 hex (which appears as 246 decimal in many utility programs) is in fact a negative 10 (-10 decimal). However, you obviously can not have a negative number of clusters!  So, a negative number here is instead an indicator  that the record length for any MFT File Record is: 2 to the power of the absolute value of this negative number; which of course, results in a positive number.  For our example values above, that would be: 2 ^ (|-10|) = 2 ^ 10 = 1024 bytes!  This number agrees perfectly with the MFT Record sizes we've seen on real disks. Microsoft® finally documented this in their Windows XP Professional Resource Kit, Table 28-17, stating: "If this number is positive (up to 0x7F), it represents Clusters per MFT record. If the number is negative (0x80 to 0xFF), the size of the File Record is 2 raised to the absolute value of this number." Prior to this, we had already reached the similar outcome as expressed in note (c) on page 49 of the Linux-NTFS Project's ntfsdoc.pdf file.

41h 3 Bytes 000000 N/A  Most often set to zero, but unused by NTFS.
44h Signed
(+/-)
Byte
01 1 Clusters per
Index Buffer.

 Thus, the size of each Index Buffer; used to allocate space for NTFS structures such as Directories.

45h 3 Bytes 000000 N/A  Most often set to zero, but unused by NTFS.
48h Long
Long
Word

(8 Bytes)
B4A4E199
A4E15DFC
- NTFS Volume Serial Number.
 

 NOTE: When you use the DIR command and others inside of a CMD/DOS-box under Windows 2000/XP, it will show a Volume Serial Number composed of only the last four bytes of this Long Long Word! Example:
     C:\>dir
     Volume in drive C is Win2000
     Volume Serial Number is A4E1-5DFC
Obviously, we must look into this further to find out how all these bytes are being used by the Operating System!

 It is interesting to note how the (3rd and 4th) and (6th and 7th) bytes repeat here!
 Do you have a Serial Number where these two sets of bytes are not the same?

50h Double 
Word
00000000 0  Not Used by NTFS
 We've never seen anything except all zero bytes in this field, but some call this field a 'Checksum'.


The NTFS “$Boot” Sectors

   As stated above, it's been our experience that both the Windows 2000 and Windows XP Boot Record (a single sector) plus the “Bootstrap Code” consists of seven sectors beginning with the one we're examining in detail on this page. But the code itself shows that all 16 sectors of the NTFS Boot Record "area" are loaded into Memory. In NTFS file system terminology, the first 16 sectors of an NTFS partition are known as the $Boot (which occupies Clusters 0 through 1 on most systems; those with 8-sector/4 KB clusters).

The Second sector always begins with the 16 Hex bytes:

05 00 4E 00 54 00 4C 00 44 00 52 00 04 00 24 00
            N       T       L       D       R                 $

which is mostly Unicode for the 5 characters: NTLDR. The Third through Sixth sectors don't really have any outstanding features, and the Seventh sector ends with 138 zero bytes (300 in the original code prior to Windows™ XP SP2). On a newly formatted NTFS volume, the $Boot is immediately followed by the $MFT (Master File Table) which usually contains a number of sectors full of FF bytes (often part of $Bitmap) before you can find something which is humanly intelligible! Most NTFS volumes will also contain some Metadata (system files) in the middle of the partition; such as, $MFTMirr (a backup copy of the first four $MFT records) and $LogFile (which is the NTFS journal and can be many megabytes in size). NOTE: On volumes that have had many files added and deleted, and especially those which have come close to running out of space, the Mast File Table may have been relocated.

 




An Examination of the Assembly Code


Location of Error Messages and
Message Offsets in Memory


       0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F
7D83           0D 0A 41 20 64 69 73 6B 20 72 65 61 64      ..A disk read
7D90  20 65 72 72 6F 72 20 6F 63 63 75 72 72 65 64 00    error occurred.
7DA0  0D 0A 4E 54 4C 44 52 20 69 73 20 6D 69 73 73 69   ..NTLDR is missi
7DB0  6E 67 00 0D 0A 4E 54 4C 44 52 20 69 73 20 63 6F   ng...NTLDR is co
7DC0  6D 70 72 65 73 73 65 64 00 0D 0A 50 72 65 73 73   mpressed...Press
7DD0  20 43 74 72 6C 2B 41 6C 74 2B 44 65 6C 20 74 6F    Ctrl+Alt+Del to
7DE0  20 72 65 73 74 61 72 74 0D 0A 00 00 00 00 00 00    restart........
7DF0  00 00 00 00 00 00 00 00 83 A0 B3 C9 00 00 55 AA   ..............U.

Free Boot Record Tools

See our Free Tools page for a link to PQ's Partition Info Tools (Power Quest's Partition Information viewer will list all the fields in an NTFS Bios Parameter Block). The following is a display similar to what you'll see using PQ's Partition Info program for NT (after clicking on the "Boot Record" button):

Entries 1, 2 and 23 are in the first sector of the Boot Record, but are not part of the BPB or Extended BPB. All of the red colored boxes show entries which must be zero in order for this to be an NTFS Boot Record. Note the eight-byte Serial Number in the pink box. Although documentation from Microsoft indicates that the data in the 'white' boxes (5, 8, 14 and 15) is unused by NTFS systems, we've seen only zero bytes in boxes 5, 8 and 14, and the '80 00 80 00' entry in box 15. Please refer to our detailed notes above on the BPB entries; especially for boxes 15 and 19.

 

Updated: June 6, 2007 (2007.06.06).
Updated: Jan. 29, 2009 (29.01.2009); Feb. 1, 2009 (01.02.2009); March 1, 2009 (01.03.2009); March 8, 2009 (08.03.2009); August 16, 2009 (16.08.2009); March 6, 2010 (06.03.2010); August 26, 2012 (26.08.2012).
Last Update: September 2, 2012 (02.09.2012).


You can write to me using this: contact page (opens in a new window).

MBR and Boot Records Index

The Starman's Realm Index Page