Fixup - Concept - NTFS Documentation
Description: NTFS Documentation

Home | Files | Attributes | Concepts | Glossary

# Concept - Fixup

Previous Next

## Overview

The smallest unit of disk space that NTFS uses is a Cluster. This can vary from one sector to 128 sectors, the usual number is 8 (4KB). Naturally this is dependent on the sector and Cluster. sizes declared in $Boot.

Because a single sector could fail, it's important for NTFS to be able to detect errors in a cluster. For this purpose the sectors have Fixups, which are kept in an Update Sequence Array.

Many important Metadata Records use fixups to protect data integrity

- FILE Records in the $MFT
- INDX Records in directories and other indexes
- RCRD Records in the $LogFile
- RSTR Records in the $LogFile

## What Does It Do?

The header of each of these records contains a Update Sequence Number and a buffer. The last two bytes of each sector of the record are copied into the buffer and the Update Sequence Number is written in their place.

When the record is read, the Update Sequence Number is read from the header and compared against the last two bytes of each sector. If it succeeds, then it copies the bytes in the buffer back to their original places.

## Example

Here's an example before the fixup is applied, with a cluster size of 2KB (4 Sectors).

Offset | Data | Description
--- | --- | ---
0x0000 | ... | Header
0x0028 | CD | AB |  | Update Sequence Number
0x002A | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | Update Sequence Array
... | ... |
0x01F8 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | End of Sector 1
... | ... |
0x03F8 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | End of Sector 2
... | ... |
0x05F8 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | End of Sector 3
... | ... |
0x07F8 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | End of Sector 4

Here the Update Sequence Number is 0xABCD and the Update Sequence Array is still empty.

Offset | Data | Description
--- | --- | ---
0x0000 | ... | Header
0x0028 | CD | AB |  | Update Sequence Number
0x002A | 17 | 18 | 27 | 28 | 37 | 38 | 47 | 48 | Update Sequence Array
... | ... |
0x01F8 | 11 | 12 | 13 | 14 | 15 | 16 | CD | AB | End of Sector 1
... | ... |
0x03F8 | 21 | 22 | 23 | 24 | 25 | 26 | CD | AB | End of Sector 2
... | ... |
0x05F8 | 31 | 32 | 33 | 34 | 35 | 36 | CD | AB | End of Sector 3
... | ... |
0x07F8 | 41 | 42 | 43 | 44 | 45 | 46 | CD | AB | End of Sector 4

The last two bytes of each sector have been copied into the Update Sequence Array, and the Update Sequence Number has been written over the last two bytes of each sector.

## The Details

### Writing

Before writing a fixup-protected record:

1. Add one to the Update Sequence Number (0x0000 must be skipped)
2. For each sector, copy the last two bytes into the Update Sequence Array
3. Write the new Update Sequence Number to the end of each sector
4. Write the record to disk

### Reading

When reading a fixup-protected record:

1. Read the record from disk
2. Check the magic number is correct
3. Read the Update Sequence Number
4. Compare it against the last two bytes of every sector
5. Copy the contents of the Update Sequence Array to the correct places

If any of the checks fail when reading, it could mean there is: a bad sector, disk corruption or a fault in the driver.

Copyright (C) Validate HTML Validate CSS