When you format an NTFS volume, the format program allocates the first 16 sectors for the $Boot metadata file. First sector, in fact, is a boot sector with a "bootstrap" code and the following 15 sectors are the boot sector's IPL (initial program loader). To increase file system reliability the very last sector an NTFS partition contains a spare copy of the boot sector.
On NTFS volumes, the data fields that follow the BPB form an extended BPB. The data in these fields enables Ntldr (NT loader program) to find the master file table (MFT) during startup. On NTFS volumes, the MFT is not located in a predefined sector, as on FAT16 and FAT32 volumes. For this reason, the MFT can be moved if there is a bad sector in its normal location. However, if the data is corrupted, the MFT cannot be located, and Windows NT/2000 assumes that the volume has not been formatted. The following example illustrates the boot sector of an NTFS volume formatted while running Windows 2000. The printout is formatted in three sections: Bytes 0x00- 0x0A are the jump instruction and the OEM ID . Bytes 0x0B-0x53 are the BPB and the extended BPB. The remaining code is the bootstrap code and the end of sector marker .
Each file on an NTFS volume is represented by a record in a special file called the master file table (MFT). NTFS reserves the first 16 records of the table for special information. The first record of this table describes the master file table itself, followed by a MFT mirror record. If the first MFT record is corrupted, NTFS reads the second record to find the MFT mirror file, whose first record is identical to the first record of the MFT. The locations of the data segments for both the MFT and MFT mirror file are recorded in the boot sector.
On NTFS volumes, the data fields that follow the BPB form an extended BPB. The data in these fields enables Ntldr (NT loader program) to find the master file table (MFT) during startup. On NTFS volumes, the MFT is not located in a predefined sector, as on FAT16 and FAT32 volumes. For this reason, the MFT can be moved if there is a bad sector in its normal location. However, if the data is corrupted, the MFT cannot be located, and Windows NT/2000 assumes that the volume has not been formatted. The following example illustrates the boot sector of an NTFS volume formatted while running Windows 2000. The printout is formatted in three sections: Bytes 0x00- 0x0A are the jump instruction and the OEM ID . Bytes 0x0B-0x53 are the BPB and the extended BPB. The remaining code is the bootstrap code and the end of sector marker .
Each file on an NTFS volume is represented by a record in a special file called the master file table (MFT). NTFS reserves the first 16 records of the table for special information. The first record of this table describes the master file table itself, followed by a MFT mirror record. If the first MFT record is corrupted, NTFS reads the second record to find the MFT mirror file, whose first record is identical to the first record of the MFT. The locations of the data segments for both the MFT and MFT mirror file are recorded in the boot sector.
Byte Offset
|
Field Length
|
Field Name
|
|---|---|---|
| 0x00 |
3 bytes
|
Jump Instruction
|
| 0x03 |
LONGLONG
|
OEM ID
|
| 0x0B |
25 bytes
|
BPB
|
| 0x24 |
48 bytes
|
Extended BPB
|
| 0x54 |
426 bytes
|
Bootstrap Code
|
| 0x01FE |
WORD
|
End of Sector Marker
|
No comments:
Post a Comment