WINDOWS 1002000 PROFESSIONAL RESOURCE KIT [Electronic resources] نسخه متنی

Disk Sectors Critical to Startup

The two sectors critical to starting your computer are the master boot record (MBR), which is always located at sector 1 of cylinder 0, head 0, the first sector of a hard disk, and the boot sector, which resides at sector 1 of each volume. These sectors contain both executable code and the data required to run the code.

NOTE

---

The use of basic or dynamic disk does not affect where the MBR is located on disk and only minor differences exist between the two for how the partition table is configured. However, as the Disk Management database contains the information where dynamic volumes begin and end, the method of walking, or navigating, partition tables to find the start and end of partitions and logical volumes, as well as finding volume boot sectors, does not work on dynamic disks. Disk editing tools, such as DiskProbe and third-party tools, can walk the partitions as expected with basic disks. Also, many disk editor tools that work with Windows NT and NTFS are not currently compatible with FAT32 boot sectors and volumes.

Master Boot Record

The MBR, the most important data structure on the disk, is created when the disk is partitioned. The MBR contains a small amount of executable code called the master boot code, the disk signature, and the partition table for the disk. At the end of the MBR is a 2-byte structure called a signature word or end of sector marker, which is always set to 0x55AA. A signature word also marks the end of an extended boot record (EBR) and the boot sector.

The disk signature, a unique number at offset 0x01B8, identifies the disk to the operating system. Windows 2000 uses the disk signature as an index to store and retrieve information about the disk in the registry subkey HKEY_LOCAL_MACHINESYSTEMMountedDevices.

Master Boot Code

The master boot code performs the following activities:

Scans the partition table for the active partition.

Finds the starting sector of the active partition.

Loads a copy of the boot sector from the active partition into memory.

Transfers control to the executable code in the boot sector.

If the master boot code cannot complete these functions, the system displays one of the following error messages:

Invalid partition table.




Error loading operating system.




Missing operating system.

NOTE

---

There is no MBR on a floppy disk. The first sector on a floppy disk is the boot sector. Although every hard disk contains an MBR, the master boot code is used only if the disk contains the active, primary partition.

For more information about troubleshooting MBR problems, see "Damaged MBRs and Boot Sectors" later in this chapter.

Partition Table

The partition table, a 64-byte data structure used to identify the type and location of partitions on a hard disk, conforms to a standard layout independent of the operating system. Each partition table entry is 16 bytes long, with a maximum of four entries. Each entry starts at a predetermined offset from the beginning of the sector, as follows:

Partition 1 0x01BE (446)

Partition 2 0x01CE (462)

Partition 3 0x01DE (478)

Partition 4 0x01EE (494)

NOTE

---

Only basic disk makes use of the partition table in Windows 2000. Dynamic disk uses the Disk Management database located at the end of the disk for disk configuration information. The partition table is not updated when volumes are deleted or extended after the dynamic disk upgrade, or when new dynamic volumes are created.

The following example shows a partial printout of an MBR revealing the partition table from a computer with three partitions. When there are fewer than four partitions on a disk, the remaining partition table fields are set to the value 0.

000001B0:                                              80 01                 ..
000001C0: 01 00 07 FE BF 09 3F 00  - 00 00 4B F5 7F 00 00 00   ......?...K. ...
000001D0: 81 0A 07 FE FF FF 8A F5  - 7F 00 3D 26 9C 00 00 00   ........ .=&....
000001E0: C1 FF 05 FE FF FF C7 1B  - 1C 01 D6 96 92 00 00 00   ................
000001F0: 00 00 00 00 00 00 00 00  - 00 00 00 00 00 00         ..............

Table 32.2 describes the fields in each entry in the partition table. The sample values correspond to the first partition table entry shown in this example. The Byte Offset values correspond to the addresses of the first partition table entry. There are three additional entries whose values can be calculated by 10h to the byte offset value specific for each additional partition table entry (for example, add 20h for partition table entry 3 and 30h for partition table entry 4).

Table 32.2 Partition Table Fields

A BYTE is 8 bits, a WORD is 16 bits, a DWORD is 32 bits, and a LONGLONG is 64 bits. Sample values marked with an asterisk (*) do not accurately represent the value of the fields, because the fields are either 6 bits or 10 bits and the data is recorded in bytes.

Numbers larger than one byte are stored in little endian format, or reverse-byte ordering. Little endian format is a method of storing a number so that the least significant byte appears first in the hexadecimal number notation. For example, the sample value for the Relative Sectors field in the previous table, 0x3F000000, is a little endian representation of 0x0000003F. The decimal equivalent of this little endian number is 63.

Boot Indicator Field

The first element of the partition table, the Boot Indicator field, indicates whether or not the volume is the active partition. Only one primary partition on the disk can have this field set.

It is possible to have different operating systems and different file systems on different volumes. By using disk configuration tools such as the Windows 2000-based Disk Management or the MS-DOS-based Fdisk to designate a primary partition as active, the Boot Indicator field for that partition is set in the partition table.

System ID Field

Another element of the partition table is the System ID field. It defines which file system, such as FAT16, FAT32, or NTFS, was used to format the volume and the FT characteristics of the volume. The System ID field also identifies an extended partition, if one is defined. Windows 2000 uses the System ID field to determine which file system device drivers to load during startup. Table 32.3 identifies the values for the System ID field.

Table 32.3 System ID Values

Partition types denoted with an asterisk (*) indicate that they are also used to designate non-FT configurations such as striped and spanned volumes.

When a mirrored or RAID-5 volume is created in Windows NT 4.0 or earlier, the high bit of the System ID field byte is set for each primary partition or logical drive that is a member of the volume. For example, a FAT16 primary partition or logical drive that is a member of a mirrored or RAID-5 volume, has a System ID value of 0x86. A FAT32 primary partition or logical drive has a System ID value of 0x8B, and an NTFS primary partition or logical drive has a System ID value of 0x87. Partitions that have the high bit set can only be directly accessed by Windows 2000 and Windows NT. Shared folders on FT disks, however, are also available to computers running MS-DOS, Windows 95, and Windows 98.

NOTE

---

MS-DOS can only access volumes that have a System ID value of 0x01, 0x04, 0x05, or 0x06. However, you can delete volumes that have the other values listed in Table 32.3 using MS-DOS tools such as Fdisk. If you use a low-level disk editor, such as DiskProbe, you can read and write to any sector, including ones that are in NTFS volumes.

Starting and Ending Cylinder, Head, and Sector Fields

The Starting and Ending Cylinder, Head, and Sector fields (collectively known as the CHS fields) are additional elements of the partition table. These fields are essential for starting the computer. The master boot code uses these fields to find and load the boot sector of the active partition. The Starting CHS fields for non-active partitions point to the boot sectors of the remaining primary partitions and the EBR of the first logical drive in the extended partition as shown in Figure 32.1

Knowing the starting sector of an extended partition is very important for low-level disk troubleshooting. If your disk fails, you need to work with the partition starting point (among other factors) to retrieve stored data.

NOTE

---

To have a written record of the starting and ending sectors of the partitions on your hard disk, as well as other useful disk configuration data, use the DiskMap tool. For more information about DiskMap, see the documentation provided on the Windows 2000 Resource Kit companion CD.

Figure 32.1 shows the MBR, partition table, and boot sectors on a disk with four partitions. The definitions of the fields in the partition table and the extended partition tables are the same.

Figure 32.1 Detail of a Basic Disk with Four Partitions

The Ending Cylinder field in the partition table is 10 bits long, which limits the number of cylinders that can be described in the partition table to a range of 0-1,023. The Starting Head and Ending Head fields are each one byte long, which limits the field range to 0-255. The Starting Sector and Ending Sector fields are each six bits long, which limits the range of these fields to 0-63. However, the enumeration of sectors starts at 1 (not 0, as for other fields), so the maximum number of sectors per track is 63.

Because all hard disks are low-level formatted with a standard 512-byte sector, the maximum disk capacity described by the partition table is calculated as follows:

Maximum capacity = sector size x cylinders (10 bits) x heads (8 bits) x
sectors per track (6 bits)

Using the maximum possible values yields:

512 x 1024 x 256 x 63 (or 512 x 2^24) = 8,455,716,864 bytes or 7.8 GB

The calculation results in a maximum capacity of slightly less than 8 gigabytes (GB). Before BIOS INT 13h extensions drive geometry translation (also known as logical block addressing, or LBA) were introduced, the active, primary partition could not exceed 7.8 GB, regardless of the file system used.

IMPORTANT

---

When using the standard 512-byte sector, the maximum cluster size that you can use for FAT16 volumes while running Windows 2000 is 64 kilobytes (KB). Therefore, the maximum size for a FAT16 volume is 4 GB.

If you use a multiple-boot configuration with Windows 95, Windows 98, or MS-DOS, FAT16 volumes must be limited to 2 GB to be accessed from these operating systems. In addition, a Macintosh computer that accesses volumes on a computer running Windows 2000 cannot access a FAT16 volume that is larger than 2 GB. If you try to use a FAT16 volume larger than 2 GB when running MS-DOS, Windows 95, or Windows 98, or try to access such a volume from a Macintosh computer, you might get a message that zero bytes are available.

The maximum FAT16 volume size that you can use on a computer depends on the disk geometry and the maximum values that fit in the partition table entry fields. Table 32.4 shows the typical FAT16 volume size when LBA is enabled or disabled. The number of cylinders in both cases is 1,024 (0-1,023). When a primary partition or logical drive extends beyond the 1,023rd cylinder, all fields described in this section contain the maximum values.

Table 32.4 FAT16 Volume Size When LBA Is Enabled or Disabled

WARNING

---

Do not change the LBA setting on any hard disk containing data. You can adversely affect the process in which the system translates the disk attributes for storing data and corrupt all the files and partitions on the physical disk. Refer to your computer owner's manual before modifying this BIOS setting.

To accommodate sizes larger than 7.8 GB, Windows 2000 ignores the values in the Starting and Ending Sector fields of the partition table in favor of the Relative Sectors and Total Sectors fields.

Relative Sectors and Total Sectors Fields

The Relative Sectors field represents the offset from the beginning of the disk to the beginning of the volume, counting by sectors, for the volume described by the partition table entry. The Total Sectors field represents the total number of sectors in the volume.

Using the Relative Sectors and Total Sectors fields (resulting in a 32-bit number) provides eight more bits than the CHS scheme to represent the total number of sectors. This allows partitions containing up to 2³² sectors to be defined. With a standard sector size of 512 bytes, the 32 bits used to represent the Relative Sectors and Total Sectors fields translates into a maximum partition size of 2 terabytes (or 2,199,023,255,552 bytes).

This addressing scheme is only used in Windows 2000 with NTFS and FAT32.

NOTE

---

In addition, the Format tool of Windows 2000 limits the maximum size of FAT32 volumes it can create to 32 GB. However, Windows 2000 can directly access larger FAT32 volumes created by Windows 95 OSR2 or Windows 98.

Windows 2000 uses the fields in the partition table entries to access all partitions. A partition that is formatted while Windows 2000 is running puts data into the Starting and Ending CHS fields to have compatibility with MS-DOS, Windows 95, and Windows 98, and to maintain compatibility with the BIOS INT 13h for startup.

Extended Boot Record

An EBR, which consists of an extended partition table and the signature word for the sector, exists for each logical drive in the extended partition. It contains the only information on the first side of the first cylinder of each logical drive in the extended partition. The boot sector in a logical drive is usually located at either Relative Sector 32 or 63. However, if there is no extended partition on a disk, there are no EBRs and no logical drives.

NOTE

---

This information applies only to disks configured with basic disk.

The first entry in an extended partition table for the first logical drive points to its own boot sector. The second entry points to the EBR of the next logical drive. If no further logical drives exist, the second entry is not used and is recorded as a series of zeroes. If there are additional logical drives, the first entry of the extended partition table for the second logical drive points to its own boot sector. The second entry of the extended partition table for the second logical drive points to the EBR of the next logical drive. The third and fourth entries of an extended partition table are never used.

As shown in Figure 32.2, the EBRs of the logical drives in the extended partition are a linked list. The figure shows three logical drives on an extended partition, illustrating the difference in extended partition tables between preceding logical drives and the last logical drive.

Figure 32.2 Detail of an Extended Partition

With the exception of the last logical drive on the extended partition, the format of the extended partition table, described in Table 32.5, is repeated for each logical drive: the first entry identifies the logical drive's own boot sector and the second entry identifies the next logical drive's EBR. The extended partition table for the last logical drive has only its own partition entry listed. The second through fourth entries of the last extended partition table are not used.

Table 32.5 Contents of Extended Partition Table Entries

The fields in each entry of the extended partition table are identical to the MBR partition table entries. See Table 32.2 for more information about partition table fields.

The Relative Sectors field in an extended partition table entry shows the number of bytes that are offset from the beginning of the extended partition to the first sector in the logical drive. The number in the Total Sectors field refers to the number of sectors that make up the logical drive. The value of the Total Sectors field equals the number of sectors from the boot sector defined by the extended partition table entry to the end of the logical drive.

Because of the importance of the MBR and EBR sectors, it is recommended that you run disk-scanning tools regularly as well as regularly back up all your data files to protect against losing access to a volume or an entire disk.

Boot Sector

The boot sector, located at sector 1 of each volume, is a critical disk structure for starting your computer. It contains executable code and data required by the code, including information that the file system uses to access the volume. The boot sector is created when you format a volume. At the end of the boot sector is a two-byte structure called a signature word or end of sector marker, which is always set to 0x55AA. On computers running Windows 2000, the boot sector on the active partition loads into memory and starts Ntldr, which loads the operating system.

The Windows 2000 boot sector consists of the following elements:

An x86-based CPU jump instruction.

The original equipment manufacturer identification (OEM ID).

The BIOS parameter block (BPB), a data structure.

The extended BPB.

The executable boot code (or bootstrap code) that starts the operating system.

NOTE

---

All Windows 2000 boot sectors contain these elements. However, the NTFS boot sector, the FAT16, and the FAT32 boot sectors are all formatted differently.

The BPB describes the physical parameters of the volume: the extended BPB begins immediately after the BPB. Due to differing types of fields and the amount of data they contain, the length of the BPB is different for FAT16, FAT32, and NTFS boot sectors.

The information in the BPB and the extended BPB is used by disk device drivers to read and configure volumes. The area following the extended BPB typically contains executable boot code, which performs the actions necessary to continue the startup process.

Boot Sector Startup Processes

Computers use the boot sector to run instructions during startup. The initial startup process is summarized in the following steps:

The system BIOS and the CPU initiate the power-on self test (POST).

The BIOS searches for a boot device (typically a disk).

The BIOS loads the first physical sector of the boot device into memory and transfers CPU execution to that memory address.

If the boot device is on a hard disk, the BIOS loads the MBR. The master boot code in the MBR loads the boot sector of the active partition, and transfers CPU execution to that memory address. On computers that are running Windows 2000, the executable boot code in the boot sector finds Ntldr, loads it into memory, and transfers execution to that file.

NOTE

---

Windows 2000 cannot start up from a spanned, striped, or RAID-5 volume running dynamic disk. These disk structures cannot be registered into the MBR's partition table, so a system partition using these structures is not startable. Windows 2000 must be fully loaded into memory before they can be used.

If there is a floppy disk in drive A, the system BIOS loads the first sector (the boot sector) of the disk into memory. If the disk is startable—formatted by MS-DOS with core operating system files applied—the boot sector loads into memory and uses the executable boot code to transfer CPU execution to Io.sys, a core MS-DOS operating system file. If the floppy disk is not bootable, the executable boot code displays an error message such as:

Non-System disk or disk error
Replace and press any key when ready

NOTE

---

This error will not appear on normally functioning systems that are configured to look for the startup files on drive C first. On many computers, an option in the CMOS setup program allows the user to set the sequence of installed disks that the system searches for the startup files.

If you get similar errors when trying to start the computer from the hard disk, the boot sector might be corrupted. For more information about troubleshooting boot sector problems, see "Damaged MBRs and Boot Sectors" later in this chapter.

Initially, the startup process is independent of disk format and operating system. The unique characteristics of operating and file systems become important when the boot sector's executable boot code starts.

Components of a Boot Sector

The MBR transfers CPU execution to the boot sector, so the first three bytes of the boot sector must be valid, executable x86-based CPU instructions. This includes a jump instruction that skips the next several nonexecutable bytes.

Following the jump instruction is the 8-byte OEM ID, a string of characters that identifies the name and version number of the operating system that formatted the volume. To preserve compatibility with MS-DOS, Windows 2000 records "MSDOS5.0" in this field on FAT16 and FAT32 disks. On NTFS disks, Windows 2000 records "NTFS."

NOTE

---

You may also see the OEM ID "MSWIN4.0" on disks formatted by Windows 95 and "MSWIN4.1" on disks formatted by Windows 95 OSR2 and Windows 98. Windows 2000 does not use the OEM ID field in the boot sector except for verifying NTFS volumes.

Following the OEM ID is the BPB, which provides information that enables the executable boot code to locate Ntldr. The BPB always starts at the same offset, so standard parameters are in a known location. Disk size and geometry variables are encapsulated in the BPB. Because the first part of the boot sector is an x86 jump instruction, the BPB can be extended in the future by appending new information at the end. The jump instruction needs only a minor adjustment to accommodate this change. The BPB is stored in a packed (unaligned) format.

FAT16 Boot Sector

Table 32.6 describes the boot sector of a volume formatted with the FAT16 file system.

Table 32.6 Boot Sector Sections on a FAT16 Volume

The following example illustrates a hexadecimal printout of the boot sector on a FAT16 volume. The printout is formatted in three sections:

Bytes 0x00—0x0A are the jump instruction and the OEM ID (shown in bold print).

Bytes 0x0B—0x3D are the BPB and the extended BPB.

The remaining section is the bootstrap code and the end of sector marker (shown in bold print).

Physical Sector: Cyl 0, Side 1, Sector 1
00000000: EB 3C 90 4D 53 44 4F 53  - 35 2E 30 00 02 40 01 00   .<.MSDOS5.0..@..
00000010: 02 00 02 00 00 F8 FC 00  - 3F 00 40 00 3F 00 00 00   ........?.@.?...
00000020: 01 F0 3E 00 80 00 29 A8  - 8B 36 52 4E 4F 20 4E 41   ..>...)..6RNO NA
00000030: 4D 45 20 20 20 20 46 41  - 54 31 36 20 20 20 33 C0   ME    FAT16   3.
00000040: 8E D0 BC 00 7C 68 C0 07  - 1F A0 10 00 F7 26 16 00   ....|h......&..
00000050: 03 06 0E 00 50 91 B8 20  - 00 F7 26 11 00 8B 1E 0B   ....P.. ..&.....
00000060: 00 03 C3 48 F7 F3 03 C8  - 89 0E 08 02 68 00 10 07   ...H........h...
00000070: 33 DB 8F 06 13 02 89 1E  - 15 02 0E E8 90 00 72 57   3.............rW
00000080: 33 DB 8B 0E 11 00 8B FB  - 51 B9 0B 00 BE DC 01 F3   3.......Q.......
00000090: A6 59 74 05 83 C3 20 E2  - ED E3 37 26 8B 57 1A 52   .Yt... ...7&.W.R
000000A0: B8 01 00 68 00 20 07 33  - DB 0E E8 48 00 72 28 5B   ...h. .3...H.r([
000000B0: 8D 36 0B 00 8D 3E 0B 02  - 1E 8F 45 02 C7 05 F5 00   .6...>....E.....
000000C0: 1E 8F 45 06 C7 45 04 0E  - 01 8A 16 24 00 EA 03 00   ..E..E.....$....
000000D0: 00 20 BE 86 01 EB 03 BE  - A2 01 E8 09 00 BE C1 01   . ..............
000000E0: E8 03 00 FB EB FE AC 0A  - C0 74 09 B4 0E BB 07 00   .........t......
000000F0: CD 10 EB F2 C3 50 4A 4A  - A0 0D 00 32 E4 F7 E2 03   .....PJJ...2....
00000100: 06 08 02 83 D2 00 A3 13  - 02 89 16 15 02 58 A2 07   .............X..
00000110: 02 A1 13 02 8B 16 15 02  - 03 06 1C 00 13 16 1E 00   ................
00000120: F7 36 18 00 FE C2 88 16  - 06 02 33 D2 F7 36 1A 00   .6........3..6..
00000130: 88 16 25 00 A3 04 02 A1  - 18 00 2A 06 06 02 40 3A   ..%.......*...@:
00000140: 06 07 02 76 05 A0 07 02  - 32 E4 50 B4 02 8B 0E 04   ...v....2.P.....
00000150: 02 C0 E5 06 0A 2E 06 02  - 86 E9 8B 16 24 00 CD 13   ............$...
00000160: 0F 83 05 00 83 C4 02 F9  - CB 58 28 06 07 02 76 11   .........X(...v.
00000170: 01 06 13 02 83 16 15 02  - 00 F7 26 0B 00 03 D8 EB   ..........&.....
00000180: 90 A2 07 02 F8 CB 42 4F  - 4F 54 3A 20 43 6F 75 6C   ......BOOT: Coul
00000190: 64 6E 27 74 20 66 69 6E  - 64 20 4E 54 4C 44 52 0D   dn't find NTLDR.
000001A0: 0A 00 42 4F 4F 54 3A 20  - 49 2F 4F 20 65 72 72 6F   ..BOOT: I/O erro
000001B0: 72 20 72 65 61 64 69 6E  - 67 20 64 69 73 6B 0D 0A   r reading disk..
000001C0: 00 50 6C 65 61 73 65 20  - 69 6E 73 65 72 74 20 61   .Please insert a
000001D0: 6E 6F 74 68 65 72 20 64  - 69 73 6B 00 4E 54 4C 44   nother disk.NTLD
000001E0: 52 20 20 20 20 20 20 00  - 00 00 00 00 00 00 00 00   R      .........
000001F0: 00 00 00 00 00 00 00 00  - 00 00 00 00 00 00 55 AA   ..............U.

Tables 32.7 and 32.8 illustrate the layout of the BPB and the extended BPB for FAT16 volumes. The sample values correspond to the data in this example.

Table 32.7 BPB Fields for FAT16 Volumes

FAT32 Boot Sector

Table 32.9 describes the boot sector of a volume formatted with the FAT32 file system.

NOTE

---

The FAT32 boot sector is structurally very similar to the FAT16 boot sector, but the FAT32 BPB contains additional fields. The FAT32 extended BPB uses the same fields as FAT16, but the offset addresses of these fields within the boot sector are different than those found in FAT16 boot sectors. Drives formatted in FAT32 are not readable by operating systems that are incompatible with FAT32.

Table 32.9 Boot Sector Sections on a FAT32 Volume

The following example illustrates a hexadecimal printout of the boot sector on a FAT32 volume. The printout is formatted in three sections:

Bytes 0x00—0x0A are the jump instruction and the OEM ID (shown in bold print).

Bytes 0x0B—0x59 are the BPB and the extended BPB.

The remaining section is the bootstrap code and the end of sector marker (shown in bold print).

Physical Sector: Cyl 878, Side 0, Sector 1     
00000000: EB 58 90 4D 53 44 4F 53  - 35 2E 30 00 02 08 20 00   .X.MSDOS5.0... .
00000010: 02 00 00 00 00 F8 00 00  - 3F 00 FF 00 EE 39 D7 00   ........?....9..
00000020: 7F 32 4E 00 83 13 00 00  - 00 00 00 00 02 00 00 00   2N.............
00000030: 01 00 06 00 00 00 00 00  - 00 00 00 00 00 00 00 00   ................
00000040: 80 00 29 8B 93 6D 54 4E  - 4F 20 4E 41 4D 45 20 20   ..)..mTNO NAME  
00000050: 20 20 46 41 54 33 32 20  - 20 20 33 C9 8E D1 BC F4     FAT32   3.....
00000060: 7B 8E C1 8E D9 BD 00 7C  - 88 4E 02 8A 56 40 B4 08   {......|.N..V@..
00000070: CD 13 73 05 B9 FF FF 8A  - F1 66 0F B6 C6 40 66 0F   ..s......f...@f.
00000080: B6 D1 80 E2 3F F7 E2 86  - CD C0 ED 06 41 66 0F B7   ....?.......Af..
00000090: C9 66 F7 E1 66 89 46 F8  - 83 7E 16 00 75 38 83 7E   .f..f.F..~..u8.~
000000A0: 2A 00 77 32 66 8B 46 1C  - 66 83 C0 0C BB 00 80 B9   *.w2f.F.f.......
000000B0: 01 00 E8 2B 00 E9 48 03  - A0 FA 7D B4 7D 8B F0 AC   ...+..H...}.}...
000000C0: 84 C0 74 17 3C FF 74 09  - B4 0E BB 07 00 CD 10 EB   ..t.<.t.........
000000D0: EE A0 FB 7D EB E5 A0 F9  - 7D EB E0 98 CD 16 CD 19   ...}....}.......
000000E0: 66 60 66 3B 46 F8 0F 82  - 4A 00 66 6A 00 66 50 06   f`f;F...J.fj.fP.
000000F0: 53 66 68 10 00 01 00 80  - 7E 02 00 0F 85 20 00 B4   Sfh.....~.... ..
00000100: 41 BB AA 55 8A 56 40 CD  - 13 0F 82 1C 00 81 FB 55   A..U.V@........U
00000110: AA 0F 85 14 00 F6 C1 01  - 0F 84 0D 00 FE 46 02 B4   .............F..
00000120: 42 8A 56 40 8B F4 CD 13  - B0 F9 66 58 66 58 66 58   B.V@......fXfXfX
00000130: 66 58 EB 2A 66 33 D2 66  - 0F B7 4E 18 66 F7 F1 FE   fX.*f3.f..N.f...
00000140: C2 8A CA 66 8B D0 66 C1  - EA 10 F7 76 1A 86 D6 8A   ...f..f....v....
00000150: 56 40 8A E8 C0 E4 06 0A  - CC B8 01 02 CD 13 66 61   V@............fa
00000160: 0F 82 54 FF 81 C3 00 02  - 66 40 49 0F 85 71 FF C3   ..T.....f@I..q..
00000170: 4E 54 4C 44 52 20 20 20  - 20 20 20 0D 0A 4E 54 4C   NTLDR      ..NTL
00000180: 44 52 20 69 73 20 6D 69  - 73 73 69 6E 67 FF 0D 0A   DR is missing...
00000190: 44 69 73 6B 20 65 72 72  - 6F 72 FF 0D 0A 50 72 65   Disk error...Pre
000001A0: 73 73 20 61 6E 79 20 6B  - 65 79 20 74 6F 20 72 65   ss any key to re
000001B0: 73 74 61 72 74 0D 0A 00  - 00 00 00 00 00 00 00 00   start...........
000001C0: 00 00 00 00 00 00 00 00  - 00 00 00 00 00 00 00 00   ................
000001D0: 00 00 00 00 00 00 00 00  - 00 00 00 00 00 00 00 00   ................
000001E0: 00 00 00 00 00 00 00 00  - 00 00 00 00 00 00 00 00   ................
000001F0: 00 00 00 00 00 00 00 00  - 00 7B 8E 9B 00 00 55 AA   .........{....U.

Tables 32.10 and 32.11 illustrate the layout of the BPB and the extended BPB for FAT32 volumes. The sample values correspond to the data in this example.

Table 32.10 BPB Fields for FAT32 Volumes

Table 32.11 Extended BPB Fields for FAT32 Volumes

NTFS Boot Sector

Table 32.12 describes the boot sector of a volume formatted with NTFS. The bootstrap code for an NTFS volume is longer than the 426 bytes, as shown in Table 32.12. When you format an NTFS volume, the format program allocates the first 16 sectors for the boot sector and the bootstrap code.

Table 32.12 Boot Sector Sections on an NTFS Volume

On NTFS volumes, the data fields that follow the BPB form an extended BPB. The data in these fields enables Ntldr to find the master file table (MFT) during startup. On NTFS volumes, the MFT is not located in a predefined sector, as on FAT16 and FAT32 volumes. For this reason, the MFT can be moved if there is a bad sector in its normal location. However, if the data is corrupted, the MFT cannot be located, and Windows 2000 assumes that the volume has not been formatted.

The following example illustrates the boot sector of an NTFS volume formatted while running Windows 2000. The printout is formatted in three sections:

Bytes 0x00—0x0A are the jump instruction and the OEM ID (shown in bold print).

Bytes 0x0B—0x53 are the BPB and the extended BPB.

The remaining code is the bootstrap code and the end of sector marker (shown in bold print).

Physical Sector: Cyl 0, Side 1, Sector 1     
00000000: EB 52 90 4E 54 46 53 20  - 20 20 20 00 02 08 00 00   .R.NTFS    .....
00000010: 00 00 00 00 00 F8 00 00  - 3F 00 FF 00 3F 00 00 00   ........?...?...
00000020: 00 00 00 00 80 00 80 00  - 4A F5 7F 00 00 00 00 00   ........J......
00000030: 04 00 00 00 00 00 00 00  - 54 FF 07 00 00 00 00 00   ........T.......
00000040: F6 00 00 00 01 00 00 00  - 14 A5 1B 74 C9 1B 74 1C   ...........t..t.
00000050: 00 00 00 00 FA 33 C0 8E  - D0 BC 00 7C FB B8 C0 07   .....3.....|....
00000060: 8E D8 E8 16 00 B8 00 0D  - 8E C0 33 DB C6 06 0E 00   ..........3.....
00000070: 10 E8 53 00 68 00 0D 68  - 6A 02 CB 8A 16 24 00 B4   ..S.h..hj....$..
00000080: 08 CD 13 73 05 B9 FF FF  - 8A F1 66 0F B6 C6 40 66   ...s......f...@f
00000090: 0F B6 D1 80 E2 3F F7 E2  - 86 CD C0 ED 06 41 66 0F   .....?.......Af.
000000A0: B7 C9 66 F7 E1 66 A3 20  - 00 C3 B4 41 BB AA 55 8A   ..f..f. ...A..U.
000000B0: 16 24 00 CD 13 72 0F 81  - FB 55 AA 75 09 F6 C1 01   .$...r...U.u....
000000C0: 74 04 FE 06 14 00 C3 66  - 60 1E 06 66 A1 10 00 66   t......f`..f...f
000000D0: 03 06 1C 00 66 3B 06 20  - 00 0F 82 3A 00 1E 66 6A   ....f;. ...:..fj
000000E0: 00 66 50 06 53 66 68 10  - 00 01 00 80 3E 14 00 00   .fP.Sfh.....>...
000000F0: 0F 85 0C 00 E8 B3 FF 80  - 3E 14 00 00 0F 84 61 00   ........>.....a.
00000100: B4 42 8A 16 24 00 16 1F  - 8B F4 CD 13 66 58 5B 07   .B..$......fX[.
00000110: 66 58 66 58 1F EB 2D 66  - 33 D2 66 0F B7 0E 18 00   fXfX.-f3.f.....
00000120: 66 F7 F1 FE C2 8A CA 66  - 8B D0 66 C1 EA 10 F7 36   f......f..f....6
00000130: 1A 00 86 D6 8A 16 24 00  - 8A E8 C0 E4 06 0A CC B8   ......$.........
00000140: 01 02 CD 13 0F 82 19 00  - 8C C0 05 20 00 8E C0 66   ........... ...f
00000150: FF 06 10 00 FF 0E 0E 00  - 0F 85 6F FF 07 1F 66 61   ..........o..fa
00000160: C3 A0 F8 01 E8 09 00 A0  - FB 01 E8 03 00 FB EB FE   ................
00000170: B4 01 8B F0 AC 3C 00 74  - 09 B4 0E BB 07 00 CD 10   .....<.t........
00000180: EB F2 C3 0D 0A 41 20 64  - 69 73 6B 20 72 65 61 64   .....A disk read
00000190: 20 65 72 72 6F 72 20 6F  - 63 63 75 72 72 65 64 00    error occurred.
000001A0: 0D 0A 4E 54 4C 44 52 20  - 69 73 20 6D 69 73 73 69   ..NTLDR is missi
000001B0: 6E 67 00 0D 0A 4E 54 4C  - 44 52 20 69 73 20 63 6F   ng...NTLDR is co
000001C0: 6D 70 72 65 73 73 65 64  - 00 0D 0A 50 72 65 73 73   mpressed...Press
000001D0: 20 43 74 72 6C 2B 41 6C  - 74 2B 44 65 6C 20 74 6F    Ctrl+Alt+Del to
000001E0: 20 72 65 73 74 61 72 74  - 0D 0A 00 00 00 00 00 00    restart........
000001F0: 00 00 00 00 00 00 00 00  - 83 A0 B3 C9 00 00 55 AA   ..............U.

Table 32.13 describes the fields in the BPB and the extended BPB on NTFS volumes. The fields starting at 0x0B, 0x0D, 0x15, 0x18, 0x1A, and 0x1C match those on FAT16 and FAT32 volumes. The sample values correspond to the data in this example.

Table 32.13 BPB and Extended BPB Fields on NTFS Volumes

Protecting the Boot Sector

Because a normally functioning system relies on the boot sector to access a volume, it is highly recommended that you run disk scanning tools such as Chkdsk regularly, as well as back up all of your data files to protect against data loss if you lose access to a volume.