Skip to main content

Module boot

Module boot 

Source
Expand description

NTFS Volume Boot Record ($Boot / VBR).

The first sector of an NTFS volume holds the BIOS Parameter Block (BPB) and NTFS’s extended BPB. It tells us the geometry needed to locate everything else: sector/cluster size, the total volume size, and the cluster numbers of $MFT and $MFTMirr.

§Layout (little-endian; offsets in hex)

0x03  u8[8]  OEM ID                 = "NTFS    "
0x0B  u16    bytes per sector
0x0D  u8     sectors per cluster
0x28  u64    total sectors
0x30  u64    $MFT  cluster number (LCN)
0x38  u64    $MFTMirr cluster number (LCN)
0x40  i8     clusters per file-record segment   (signed: <0 ⇒ 2^|v| bytes)
0x44  i8     clusters per index buffer          (signed: same encoding)
0x48  u64    volume serial number

Structs§

BootSector
Parsed NTFS boot sector geometry.