$Boot (7) - File - NTFS Documentation Home Files Attributes Concepts Glossary Help File - $Boot (7) Previous Next Overview This is the system file that allows the system to boot. This metadata file points at the boot sector of the volume. It contains information about the size of the volume, clusters and the MFT. It is the only file that cannot be relocated. Attributes Type Description Name 0x10 $STANDARD_INFORMATION 0x30 $FILE_NAME $Boot 0x50 $SECURITY_DESCRIPTOR 0x80 $DATA [Unnamed] Layout of the File Unnamed Data Stream Offset Size Description 0x0000 3 Jump to the boot loader routine 0x0003 8 System Id: "NTFS " 0x000B 2 Bytes per sector 0x000D 1 Sectors per cluster 0x000E 7 Unused 0x0015 1 Media descriptor (a) 0x0016 2 Unused 0x0018 2 Sectors per track 0x001A 2 Number of heads 0x001C 8 Unused 0x0024 4 Always 80 00 80 00 0x0028 8 Number of sectors in the volume 0x0030 8 LCN of VCN 0 of the $MFT 0x0038 8 LCN of VCN 0 of the $MFTMirr 0x0040 4 Clusters per MFT Record (b) 0x0044 4 Clusters per Index Record 0x0048 8 Volume serial number ~ ~ ~ 0x0200 Windows NT Loader (a) A media descriptor of 0xF8 means a hard disk (b) Occasionally this can be 0xF6, which means 1/4 Notes Other Information The first 40 bytes are the same as for FAT boot sectors, except that unused fields are zeroed. Because this file begins with a boot sector, it must start at physical cluster 0 (this is the only cluster that NTFS can not move). This forces the data attribute of this file to be non-resident. Consequently, the copy of the boot sector (critical data) can be located anywhere on the volume. For crash recovery purposes Windows NT 3.51 saves a copy of the boot sector and puts it in the logical middle of the volume. Windows NT and later put it at the end of the volume. Online Validate HTML Validate CSS $Id: boot.html,v 1.13 2001/07/11 16:31:44 flatcap Exp $
