Expand description
NTFS Volume Boot Record ($Boot / VBR).
The first sector of an NTFS volume holds the BIOS Parameter Block (BPB) and
NTFS’s extended BPB. It tells us the geometry needed to locate everything
else: sector/cluster size, the total volume size, and the cluster numbers of
$MFT and $MFTMirr.
§Layout (little-endian; offsets in hex)
0x03 u8[8] OEM ID = "NTFS "
0x0B u16 bytes per sector
0x0D u8 sectors per cluster
0x28 u64 total sectors
0x30 u64 $MFT cluster number (LCN)
0x38 u64 $MFTMirr cluster number (LCN)
0x40 i8 clusters per file-record segment (signed: <0 ⇒ 2^|v| bytes)
0x44 i8 clusters per index buffer (signed: same encoding)
0x48 u64 volume serial numberStructs§
- Boot
Sector - Parsed NTFS boot sector geometry.