$Boot (7) - File - NTFS Documentation
Description: NTFS Documentation

Home | Files | Attributes | Concepts | Glossary

# File - $Boot (7)

Previous Next

## Overview

This is the system file that allows the system to boot. This metadata file points at the boot sector of the volume. It contains information about the size of the volume, clusters and the MFT. It is the only file that cannot be relocated.

## Attributes

Type | Description | Name
--- | --- | ---
0x10 | $STANDARD_INFORMATION |
0x30 | $FILE_NAME | $Boot
0x50 | $SECURITY_DESCRIPTOR |
0x80 | $DATA | [Unnamed]

## Layout of the File

### Unnamed Data Stream

Offset | Size | Description
--- | --- | ---
0x0000 | 3 | Jump to the boot loader routine
0x0003 | 8 | System Id: "NTFS "
0x000B | 2 | Bytes per sector
0x000D | 1 | Sectors per cluster
0x000E | 7 | Unused
0x0015 | 1 | Media descriptor (a)
0x0016 | 2 | Unused
0x0018 | 2 | Sectors per track
0x001A | 2 | Number of heads
0x001C | 8 | Unused
0x0024 | 4 | Usually 80 00 80 00 (b)
0x0028 | 8 | Number of sectors in the volume
0x0030 | 8 | LCN of VCN 0 of the $MFT
0x0038 | 8 | LCN of VCN 0 of the $MFTMirr
0x0040 | 4 | Clusters per MFT Record (c)
0x0044 | 4 | Clusters per Index Record (c)
0x0048 | 8 | Volume serial number
~ | ~ | ~
0x0200 |  | Windows NT Loader

(a) A media descriptor of 0xF8 means a hard disk.
(b) A value of 80 00 00 00 has been seen on a USB thumb drive which is formatted with NTFS under Windows XP. Note this is removable media and is not partitioned, the drive as a whole is NTFS formatted.
(c) This can be negative, which means that the size of the MFT/Index record is smaller than a cluster. In this case the size of the MFT/Index record in bytes is equal to 2^(-1 * Clusters per MFT/Index record). So for example if Clusters per MFT Record is 0xF6 (-10 in decimal), the MFT record size is 2^(-1 * -10) = 2^10 = 1024 bytes.

## Notes

### Other Information

The first 40 bytes are the same as for FAT boot sectors, except that unused fields are zeroed.

Because this file begins with a boot sector, it must start at physical cluster 0 (this is the only cluster that NTFS can not move). This forces the data attribute of this file to be non-resident. Consequently, the copy of the boot sector (critical data) can be located anywhere on the volume.

For crash recovery purposes Windows NT 3.51 saves a copy of the boot sector and puts it in the logical middle of the volume. Windows NT and later put it at the end of the volume.

Copyright (C) Validate HTML Validate CSS