boot.html

NTFS 磁盘系统 加载源代码

<title>Boot file</title>
The file 7, $Boot, starts at cluster 0 of the volume. The first 0x28 bytes
are the same as for FAT boot sectors, except that useless fields are zeroed.
The last sector is stored in its own run, which is located in the logical 
center of the volume - for crash recovery.
<pre>
offset(length)   contents
0(3)             Jump to boot routine
3(4)             System ID 'NTFS    '
B(2)             Sector size of volume
D(1)             Number of sectors per cluster
E(7)             unused, zero filled
15(1)            Media descriptor (f8: hard disk)
16(2)            unused, zero filled
18(2)            Sectors per track
1A(2)            Number of heads
1C(8)            unused, zero filled
24(2)            ?unknown, set to 80
26(2)            ?unknown, set to 80
28(8)            Number of sectors in volume
30(8)            Cluster number of the master file table ($MFT)
38(8)            Cluster number of copy of the master file table ($MFTMirr)
40(1)            MFT record size in clusters. F6 seems to indicate 0.25.
44(4)            Index buffer size in clusters.
48(4)            Volume serial number
4C(4)            ?
50(D)            unused, zero filled
5D(1A1)          Boot routine
1FE(2)           Magic boot sector ID (AA55)
200              more code, probably NT kernel loader
last 200 bytes   copy of first 0x200 bytes
</pre>