Partition Boot Sector
Table 5-1 describes the boot sector of a volume formatted with NTFS. When you format an NTFS volume, the format program allocates the first 16 sectors for the boot sector and the bootstrap code.Table 5-1 NTFS Boot Sector
Byte Offset
Field Length
Field Name
0x003 bytesJump Instruction 0x03LONGLONGOEM ID 0x0B25 bytesBPB0x24 48 bytesExtended BPB 0x54 426 bytesBootstrap Code 0x01FEWORDEnd of Sector MarkerOn NTFS volumes, the data fields that follow the BPB form an extended BPB. The data in these fields enables Ntldr (NT loader program) to find the master file table (MFT) during startup. On NTFS volumes, the MFT is not located in a predefined sector, as on FAT16 and FAT32 volumes. For this reason, the MFT can be moved if there is a bad sector in its normal location. However, if the data is corrupted, the MFT cannot be located, and Windows NT/2000 assumes that the volume has not been formatted.
The following example illustrates the boot sector of an NTFS volume formatted while running Windows 2000. The printout is formatted in three sections:
[*]Bytes 0x00- 0x0A are the jump instruction and the OEM ID (shown in bold print).[*]Bytes 0x0B-0x53 are the BPB and the extended BPB.[*]The remaining code is the bootstrap code and the end of sector marker (shown in bold print).
The following table describes the fields in the BPB and the extended BPB on NTFS volumes. The fields starting at 0x0B, 0x0D, 0x15, 0x18, 0x1A, and 0x1C match those on FAT16 and FAT32 volumes. The sample values correspond to the data in this example.
Byte OffsetField LengthSample ValueField Name0x0B
WORD
0x0002
Bytes Per Sector
0x0D
BYTE
0x08
Sectors Per Cluster
0x0E
WORD
0x0000
Reserved Sectors
0x10
3 BYTES
0x000000
always 0
0x13
WORD
0x0000
not used by NTFS
0x15
BYTE
0xF8
Media Descriptor
0x16
WORD
0x0000
always 0
0x18
WORD
0x3F00
Sectors Per Track
0x1A
WORD
0xFF00
Number Of Heads
0x1C
DWORD
0x3F000000
Hidden Sectors
0x20
DWORD
0x00000000
not used by NTFS
0x24
DWORD
0x80008000
not used by NTFS
0x28
LONGLONG
0x4AF57F0000000000
Total Sectors
0x30
LONGLONG
0x0400000000000000
Logical Cluster Number for the file $MFT
0x38
LONGLONG
0x54FF070000000000
Logical Cluster Number for the file $MFTMirr
0x40
DWORD
0xF6000000
Clusters Per File Record Segment
0x44
DWORD
0x01000000
Clusters Per Index Block
0x48
LONGLONG
0x14A51B74C91B741C
Volume Serial Number
0x50
DWORD
0x00000000
Checksum
Protecting the Boot SectorBecause a normally functioning system relies on the boot sector to access a volume, it is highly recommended that you run disk scanning tools such as Chkdsk regularly, as well as back up all of your data files to protect against data loss if you lose access to a volume.
[ 本帖最后由 甜橙 于 2007-11-3 16:13 编辑 ] OH,Good article!thank you! look 不明白啊
页:
[1]