Editing NTFS (section)

=== {{Anchor|PBS}} Partition Boot Sector (PBS) ===
{{clear}}
{| class="wikitable sortable plainrowheaders"
|+ NTFS boot sector contents<ref>{{cite web|url=http://www.ntfs.com/ntfs-partition-boot-sector.htm|title=NTFS. Partition Boot Sector|website=Ntfs.com  |access-date=22 September 2018}}</ref><ref>{{cite web|url=https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc976796(v=technet.10)|title=Boot Sector|website=[[Microsoft Learn]] |at=Table 1.13 BPB and Extended BPB Fields on NTFS Volumes |date=September 11, 2008 |access-date=22 September 2018}}</ref> (All values except strings are stored in [[endianness|little endian]] order.)
! scope="col" | Byte offset
! scope="col" | Field length
! scope="col" | Typical value
! colspan="2" |Field name
! scope="col" | Purpose
|-
! scope="row" | 0x00
| 3 bytes
| 0xEB5290
| colspan="2" |x86 [[JMP (x86 instruction)|JMP]] and [[NOP (code)#Machine_language_instructions|NOP]] instructions
| Causes execution to continue after the data structures in this boot sector.
|-
! scope="row" | 0x03
| 8 bytes
| "<code>NTFS&ensp;&ensp;&ensp;&ensp;</code>"<br /><small>Word "NTFS" followed by four trailing spaces (0x20)</small>
| colspan="2" |OEM ID
| This is the magic number that indicates this is an NTFS file system.
|-
! scope="row" | 0x0B
|style='background: #ADD8E6'| 2 bytes
|style='background: #ADD8E6'| 0x0200
| rowspan="11" style="background: #ADD8E6" | BPB
|style='background: #ADD8E6'| Bytes per sector
|style='background: #ADD8E6'| The number of bytes in a disk sector.
|-
! scope="row" | 0x0D
|style='background: #ADD8E6'| 1 byte
|style='background: #ADD8E6'| 0x08
|style='background: #ADD8E6'| Sectors Per Cluster
|style='background: #ADD8E6'| The number of sectors in a cluster. If the value is greater than 0x80, the amount of sectors is 2 to the power of the absolute value of considering this field to be negative.
|-
! scope="row" | 0x0E
|style='background: #ADD8E6'| 2 bytes
|style='background: #ADD8E6'| 0x0000
|style='background: #ADD8E6'| Reserved Sectors, unused
|style='background: #ADD8E6'| 
|-
! scope="row" | 0x10
|style='background: #ADD8E6'| 3 bytes
|style='background: #ADD8E6'| 0x000000
|style='background: #ADD8E6'| Unused
|style='background: #ADD8E6'| This field is always 0
|-
! scope="row" | 0x13
|style='background: #ADD8E6'| 2 bytes
|style='background: #ADD8E6'| 0x0000
|style='background: #ADD8E6'| Unused by NTFS
|style='background: #ADD8E6'| This field is always 0
|-
! scope="row" | 0x15
|style='background: #ADD8E6'| 1 byte
|style='background: #ADD8E6'| 0xF8
|style='background: #ADD8E6'| Media Descriptor
|style='background: #ADD8E6'| The type of drive. 0xF8 is used to denote a hard drive (in contrast to the several sizes of floppy).
|-
! scope="row" | 0x16
|style='background: #ADD8E6'| 2 bytes
|style='background: #ADD8E6'| 0x0000
|style='background: #ADD8E6'| Unused
|style='background: #ADD8E6'| This field is always 0
|-
! scope="row" | 0x18
|style='background: #ADD8E6'| 2 bytes
|style='background: #ADD8E6'| 0x003F
|style='background: #ADD8E6'| Sectors Per Track
|style='background: #ADD8E6'| The number of disk sectors in a drive track.
|-
! scope="row" | 0x1A
|style='background: #ADD8E6'| 2 bytes
|style='background: #ADD8E6'| 0x00FF
|style='background: #ADD8E6'| Number Of Heads
|style='background: #ADD8E6'| The number of heads on the drive.
|-
! scope="row" | 0x1C
|style='background: #ADD8E6'| 4 bytes
|style='background: #ADD8E6'| 0x0000003F
|style='background: #ADD8E6'| Hidden Sectors
|style='background: #ADD8E6'| The number of sectors preceding the partition.
|-
! scope="row" | 0x20
|style='background: #ADD8E6'| 4 bytes
|style='background: #ADD8E6'| 0x00000000
|style='background: #ADD8E6'| Unused
|style='background: #ADD8E6'| Not used by NTFS
|-
! scope="row" | 0x24
|style='background: #ADD8FF'| 4 bytes
|style='background: #ADD8FF'| 0x00800080
| rowspan="10" style="background: #ADD8FF" | EBPB
|style='background: #ADD8FF'| Unused
|style='background: #ADD8FF'| Not used by NTFS
|-
! scope="row" | 0x28
|style='background: #ADD8FF'| 8 bytes
|style='background: #ADD8FF'| 0x00000000007FF54A
|style='background: #ADD8FF'| Total sectors
|style='background: #ADD8FF'| The partition size in sectors.
|-
! scope="row" | 0x30
|style='background: #ADD8FF'| 8 bytes
|style='background: #ADD8FF'| 0x0000000000000004
|style='background: #ADD8FF'| $MFT cluster number
|style='background: #ADD8FF'| The cluster that contains the Master File Table
|-
! scope="row" | 0x38
|style='background: #ADD8FF'| 8 bytes
|style='background: #ADD8FF'| 0x000000000007FF54
|style='background: #ADD8FF'| $MFTMirr cluster number
|style='background: #ADD8FF'| The cluster that contains a backup of the Master File Table
|-
! scope="row" | 0x40
|style='background: #ADD8FF'| 1 byte
|style='background: #ADD8FF'| 0xF6
|style='background: #ADD8FF'| Bytes or Clusters Per File Record Segment
|style='background: #ADD8FF'| A positive value denotes the number of clusters in a File Record Segment. A negative value denotes the amount of bytes in a File Record Segment, in which case the size is 2 to the power of the absolute value. (0xF6 = -10 → 2<sup>10</sup> = 1024).
|-
! scope="row" | 0x41
|style='background: #ADD8FF'| 3 bytes
|style='background: #ADD8FF'| 0x000000
|style='background: #ADD8FF'| Unused
|style='background: #ADD8FF'| This field is not used by NTFS
|-
! scope="row" | 0x44
|style='background: #ADD8FF'| 1 byte
|style='background: #ADD8FF'| 0x01
|style='background: #ADD8FF'| Bytes or Clusters Per Index Buffer
|style='background: #ADD8FF'| A positive value denotes the number of clusters in an Index Buffer. A negative value denotes the amount of bytes and it uses the same algorithm for negative numbers as the "Bytes or Clusters Per File Record Segment."
|-
! scope="row" | 0x45
|style='background: #ADD8FF'| 3 bytes
|style='background: #ADD8FF'| 0x000000
|style='background: #ADD8FF'| Unused
|style='background: #ADD8FF'| This field is not used by NTFS
|-
! scope="row" | 0x48
|style='background: #ADD8FF'| 8 bytes
|style='background: #ADD8FF'| 0x1C741BC9741BA514
|style='background: #ADD8FF'| Volume Serial Number
|style='background: #ADD8FF'| A unique random number assigned to this partition, to keep things organized.
|-
! scope="row" | 0x50
|style='background: #ADD8FF'| 4 bytes
|style='background: #ADD8FF'| 0x00000000
|style='background: #ADD8FF'| Checksum, unused
|style='background: #ADD8FF'| Supposedly a checksum.
|-
! scope="row" | 0x54
| 426 bytes
|
| colspan="2" |Bootstrap Code
| The code that loads the rest of the operating system. This is pointed to by the first 3 bytes of this sector.
|-
! scope="row" | 0x01FE
| 2 bytes
| 0xAA55
| colspan="2" |End-of-sector Marker
| This flag indicates that this is a valid boot sector.
|}

This boot partition format is roughly based upon the earlier [[File Allocation Table|FAT]] filesystem, but the fields are in different locations. Some of these fields, especially the "sectors per track", "number of heads" and "hidden sectors" fields may contain dummy values on drives where they either do not make sense or are not determinable.

The OS first looks at the 8 bytes at 0x30 to find the cluster number of the $MFT, then multiplies that number by the number of sectors per cluster (1 byte found at 0x0D). This value is the sector offset ([[Logical block addressing|LBA]]) to the $MFT, which is described below.