NTFS file system DBR


DBR of NTFS file system

The effect of boot-sector of NTFS is the same as that of FAT16 and FAT32: MBR boots to DBR of active partition, then DBR boots operating system; for Windows NT/2000/XP/2003, DBR calls unfold NTLDR, and then NTLDR calls in system kernel.



DBR of NTFS



BPB parameter table

Byte offset	Length	Common range	note
0x0b	bit	0x0002	number of bytes in each sector
0x0d	byte	0x08	number of sectors in each cluster
0x0e	bit	0x000	reserved sector
0x10	3byte	0x000000	always 0
0x13	bit	0x0000	free NTFS, 0
0x15	byte	0xf8	medium description
0x16	bit	0x0000	always 0
0x18	bit	0x3f00	number of sectors in each track
0x1a	bit	0xff00	number of heads
0x1c	Double bit	0x3f000000	hidden sector
0x20	Double bit	0x00000000	free NTFS, 0
0x24	Double bit	0x80008000	free NTFS, 0
0x28	8byte	0x4af57f0000000000	total number of sectors
0x30	8byte	0x0400000000000000	logic start cluster number of $MFT
0x38	8byte	0x54ff070000000000	logic start cluster number of $MFTMirr
0x40	Double bit	0xf6000000	cluster record number of each MFT
0x44	Double bit	0x01000000	number of index cluster
0x48	8byte	0x14a51b74c91b741c	volume lable
0x50	Double bit	0x00000000	checks the sum

In NTFS volume, there is an extended BPB formed by data fields that follow the BPB. Data in these fields enables NTLDR to find master file table $MFT in starting process. In the NTFS volume, $MFT isn't placed in a pre-definition sector, which is different from that in FAT16 volume and FAT32 volume. So if there is some bad sectors in normal position of MFT, we can move the $MFT to another place. But, if the data is destroyed, the position of $MFT cannot be found out; then Windows 2000 will consider this volume as unformatted. Therefore, if a NTFS volume prompt unformatted, it is possible that $MFT is not destroyed. And it may reconstruct BPB according to the meaning of each fields of BPB.

Data Recovery Tip #3: Never place your external hard drive or computer on an unstable surface.