Link to home
Start Free TrialLog in
Avatar of vijayk
vijayk

asked on

NTFS bootsector layout

As part of my cirrent project, I have to programatically resize an NTFS partition. I have already done this for FAT16 and FAT32. I am having trouble finding information about the structure of the NTFS file system. Can someone tell me where I can get this information or atleast the structure of the NTFS bootsector?
--thanks
Rajesh Vijayakumar
Avatar of BlackMan
BlackMan

To my knowlegde, the format of the bootsector is not OS specific. The bootsector just contains code to start loading the actual OS. What is your exact problem?
A good reference is "Inside the Windows NT File System" by Helen Cluster, ISBN 1-55615-660-X. It covers almost everything about NTFS..
Ooops, typo.. The book is by Helen Custer (I've been playing to much with NT Cluster lately :-)
Avatar of vijayk

ASKER

The bootsector format is specific to the file system. I know this because I have worked with both FAT16 and FAT32 files system at the sector level and the bootsector layout is different for both. Apart from the bootup code that you mentioned, the boot sector contains information specific to the file system, like cluster size, partition size etc. I want to know where NTFS stores it's partition size so that I can change it to effectively resize the partition. The partition table also has the partition size but if I change just that, most hard disk utilities will flag it as an error.

ps:The book you mentioned is out of print. If you know of any place where I can get it, please let me know.
PSS ID Number: Q153973
Article last modified on 01-09-1998
 
3.5 3.51 4.0
 
winnt
 

======================================================================
-------------------------------------------------------------------------
The information in this article applies to:
 
 - Microsoft Windows NT Workstation versions 3.5 and 3.51
 - Microsoft Windows NT Server versions 3.5 and 3.51
 - Microsoft Windows NT Workstation versions 4.0
 - Microsoft Windows NT Server versions 4.0
-------------------------------------------------------------------------
 
SYMPTOMS
========
 
When a volume on a server or workstation becomes inaccessible or Disk
Administrator shows it as "unknown", you may have a corrupt or damaged boot
sector.  This article will tell you how to find the second copy that NTFS
stores and restore to the correct position on the disk.
 
Please keep in mind that two conditions must be met in order for this
information to apply to your issue:
 
1.  File system must be NTFS.  FAT currently does not keep a copy of the
    bootsector.
 
2.  You must be able to boot your machine to NT.
 
NOTE: If you cannot Boot into NT or move the drive to another NT machine
      then follow Knowledge Base Article:
 
           Q121517:  How to recover from a corrupt NTFS bootsector
 
RESOLUTION
==========
 
In order to resolve the problem, we need to retrieve the copy of the backup
bootsector and copy it back to the correct position on the Hard Disk.
 
In NT 3.5x, the second copy is kept in the center of the logical volume
(Volume middle).
 
In NT 4.0, it has been moved to the end of the logical volume (Volume end),
which requires a different retrieval technique.  The example shown will be
using Disk Probe (dskprobe.exe) for NT which ships on the NT V4.0 Resource
Kit but will also run under NT V3.5x with the proper .dll files installed.
 
Note:
 
To assure recovery during the following procedures, once you have verified
the NTFS boot sector and the copy to be valid, save the sector to a file
while viewing it by selecting "Save As" from the File menu and specify a
path and filename.
 
Recovering Bootsectors of Primary Partitions.
=============================================
 
1. Using Disk Probe choose DRIVES, Physical Drive.  Select the
PhysicalDriveX where X = the ordinal of the disk.  For example, Use Disk
Administrator to find what the ordinal is of the disk in question.  For
example, if I have three SCSI disks in my system with SCSI ID's 1, 3, and
5, Disk Administrator will show them in order of 0,1,2.  Furthermore, if I
remove disk with SCSI ID #3, SCSI Disk with ID #5 will move up to disk 1
and so on.
 
2. Double click on the PhysicalDriveX you wish to repair.  In the box
below, uncheck Read Only and press the Set Active button.  You will then
notice that the Active Handle has been set to PhysicalDriveX, then select
OK.
 
3. From the SECTORS Menu, select Read and insert 0 for STARTING SECTORS and
1 for Number of Sectors, Click Read.
 
4. You are now at the Master Boot Record (MBR) of your Physical disk. You
can verify this by the ASCII text on the right hand side beginning at
Offset 8B which should read "Invalid Partition Table....".  From the VIEW
menu, select "Partition Table".  From the box labeled "partition table
index", use the scroll bar to select the partition in question and double
click on that Partition.  The Box in the lower, left-hand corner shows the
Relative Sectors, note this value (on the line provided below), and  Select
the Tab "GO" next to this box.
 
Record RELATIVE SECTOR __________  value.
 
5. Now from the VIEW menu, select "Bytes" so you can verify your position.
Depending on how the Bootsector has been corrupted, you can try to identify
some ASCII strings such as NTFS in the upper Right hand corner or "A disk
Read error occurred...", beginning at offset 130.  From the VIEW menu,
select "NTFS bootsector".  In this view, select the button, "Volume End"
for NT V4.0 or "Volume Middle" for NT V3.5x  You should now be at your
backup copy of the bootsector. If you get an error stating "incomplete Data
Read" or after examining the bytes, determine this is not the backup copy
of the bootsector,  your primary bootsector was corrupt so that the values
we needed to Jump to the backup copy were incorrect.  Please go ahead to
the next section showing how to recover the bootsector when it is missing
or heavily corrupted, otherwise continue with step 6.
 
6. From the VIEW menu, select Bytes and verify that this is the NTFS
bootsector.  Once verified, From the SECTORS menu, select Write, make sure
the dialog box shows the correct Handle and PhysicalDrive.  In box Starting
Sector to write Data, type in the number of Relative sectors you
noted in step #4 and select the Button Write it.
 
7. Go to the SECTORS menu and type in the Relative sector from step #4
while keeping Number of sectors to 1, select Read.  Here, please verify
that the data was written.
 
8.  Close Disk Probe and reboot your system.
 
Recovering Backup bootsector if original copy is missing, heavily
corrupted, or does contain any usable data.
===========================================================================
 
If the bootsector is missing or corrupted in such a manner that the
information in the Primary Boot sector pointers were incorrect, usually the
number of sectors are wrong, use the following steps to recover.
 
1. Using Disk Probe choose DRIVES, Physical Drive.  Select the
PhysicalDriveX where X = the ordinal of the disk.  For example, Use Disk
Administrator to find what the ordinal is of the disk in question.
 
2. Double click on the PhysicalDriveX you wish to view.  In the box below,
uncheck Read Only and select the button Set Active.  You will then notice
that the Active Handle has been set to PhysicalDriveX, then select OK.
 
3. From the SECTORS Menu, select Read and insert 0 for STARTING SECTORS and
1 for Number of Sectors, Click Read.
 
4. You are now at the MBR of your Physical disk. You can verify this by the
ASCII text on the right hand side beginning at Offset 8b which should read
"Invalid Partition Table....".  From the VIEW menu, select view Partition
Table.  Select the correct partition number which is in question.
 
5. We will need two values; Total Sectors, Relative sectors.  Please note
the Relative sectors value since this is where the bootsector should be
located.  To find the backup copy of the bootsector, perform the following
calcualtion:
 
Record Total Sectors:    _________
Record Relative Sectors: _________
 
EXAMPLE #1:  FOR NT V4.0 WHERE THE BACKUP COPY IS AT THE END OF THE VOLUME:
 
                   Total Sectors  -->  1062880
               + relative Sectors -->       32 +
                                      ---------
                                       1062912
               - Minus one sector -->        1 -
                                      ---------
                Backup bootsector -->  1062911
 
EXAMPLE #2:  FOR NT V3.5x WHERE THE BACKUP COPY IS IN THE MIDDLE OF THE
             VOLUME:
 
                   Total Sectors  -->  1062880
                    Divided by 2  -->   531440
               + relative Sectors -->       32 +
                                      ---------
                Backup bootsector -->   531472
 
6.  Select SECTORS, Read and input Starting sector as the value calculated
in Step #5, Number of sectors to 1.  Select Read and you should be at the
location of your backup bootsector.
 
7. From the VIEW menu, select Bytes and verify that this is the NTFS
bootsector.  Once verified, from the SECTORS menu, select Write, make sure
the dialog box shows the correct Handle and PhysicalDrive.  In box Starting
Sector to write Data, type in the number of Relative sectors you
noted in step #5 and select the Buttion Write it.
 
8. Go to the SECTORS menu and type in the Relative sector from step #5
while keeping Number of sectors to 1, select Read.  Here, please verify
that the data was written.
 
9.  Close Disk Probe and reboot your system.
 
Recovering Bootsectors of extended partitions:
===============================================
 
1. Using Disk Probe choose DRIVES, Physical Drive.  Select the
PhysicalDriveX where X = the ordinal of the disk.  For example, Use Disk
Administrator to find what the ordinal is of the disk in
question.
 
2. Double click on the PhysicalDriveX you wish to view.  In the box below,
uncheck Read Only and select the button Set Active.  You will then notice
that the Active Handle has been set to PhysicalDriveX, then select OK.
 
3. From the SECTORS Menu, select Read and insert 0 for STARTING SECTORS and
1 for Number of Sectors, Click Read.
 
4. You are now at the MBR of your Physical disk. You can verify this by the
ASCII text on the right hand side beginning at Offset 8b which should read
"Invalid Partition Table....".  From the VIEW menu, select view Partition
Table.  Select VIEW , As Partition Table.
 
5.  In this view, in the Partition Table Index box, select your partition
that contains your Extended partition.  Once done, the System ID box should
read "Extended".  If the partition in question is the fourth logical drive
in the Extended partition, click the Next partition button 4 times.  The
System ID box should now read "NTFS"
 
6.  At this point, note the current sector you are on by either reading the
Title bar or lower right hand corner of the DiskProbe window.  Also make
note of the Relative Sector and Total Sectors. Select the Go button, select
VIEW as bytes and now should be at the Bootsector in question.
 
Note this location so we know where to copy the backup bootsector.
 
              Current sector    __________
              Relative sectors  __________
              Total Sectors     __________
 
7.  To find the backup copy, you will need three values, Relative Sectors,
Total Sectors, and Current sector which you noted in step #6.  Perform the
following calculation using your values:
 
EXAMPLE #1:  FOR NT V4.0 WHERE THE BACKUP COPY IS AT THE END OF THE VOLUME:
 
                         Current sector:   819200
                         Total Sectors:    243680 +
                                           ======
                                          1062880
                       Relative Sectors        32 +
                                           ======
                                          1062912
                            Less one            1 -
                                           ======
                       Backup Bootsector  1062911
 
EXAMPLE #2:  FOR NT V3.5x WHERE THE BACKUP COPY IS IN THE MIDDLE OF THE
             VOLUME:
 
                         Current sector:   819200
  + Total Sectors: 243680 divided by 2 :   121840 +
                                           ======
                                           941040
                     + Relative Sectors        32 +
                                           ======
                       Backup Bootsector   941072
 
8.  Select SECTORS, Read and input Starting sector as the value calculated
in Step #7, Number of sectors to 1.  Select Read and you should be at the
location of your backup bootsector.
 
9. From the VIEW menu, select Bytes and verify that this is the NTFS
bootsector.  Once verified, from the SECTORS menu, select Write, make sure
the dialog box shows the correct Handle and PhysicalDrive.  In box Starting
Sector to write Data, type in the sector you noted in step #6 that held the
location of the original copy. Select Write to copy the bootsector to that
location.
 
10. Go to the SECTORS menu and select Read.  In the starting sector, type
in the Sector to which you wrote the backup copy, while keeping Number of
sectors to 1. Select Read, and  verify that the data was written.
 
11.  Close Disk Probe and reboot your system.
 
Norton Diskedit is manufactured by Symantec Corporation, a vendor
independent of Microsoft; we make no warranty, implied or otherwise,
regarding this product s performance or reliability.
 
Additional query words:prodnt
======================================================================
Keywords          : ntfault ntfilesys NTSrvWkst kbother
Version           : 3.5 3.51 4.0
Platform          : winnt
=============================================================================
Copyright Microsoft Corporation 1998.


 

Avatar of vijayk

ASKER

Interesting piece of information but got no clue about how I can resize an NTFS partition.
Take a look at the technical documents
at http://WWW.PowerQuest.COM,
who are the authors of the "PartitionMagic" software,
which can be used to resize partitions.

Avatar of vijayk

ASKER

couldn't find any information on NTFS boot sector. could you give a more specific URL?
ps: sorry for the delay in responding. i had unknowingly turned off email notification.
> I have to programatically resize an NTFS partition.
> Can someone tell me where I can get this information

I did, in my answer which you rejected.

> or at least the structure of the NTFS bootsector?

You also seem have rejected the comment from "theh95".
Avatar of vijayk

ASKER

The URL you gave is the home page of PowerQuest. It doesn't have any information of the bootsector layout of NTFS. I know that I can use tools like PartitionMagic or PartitionIt to resize an NTFS partition. I need information to write my own C++ program to to this for a client of mine. To do this I have to know exactly how NTFS lays out the filesystem. I hope my question is clear now.
> The URL you gave is the home page of PowerQuest.

Correct.

> It doesn't have any information of the bootsector layout of NTFS.

A boot-sector is a boot-sector,
as far as your computer's BIOS is concerned.

> I know that I can use tools like PartitionMagic
> or PartitionIt to resize an NTFS partition.

PartitionMagic is "quality" software,
and is "well-tested".  I trust it to function correctly.

> I need information to write my own C++ program
> to to to to this for a client of mine.

I don't know if I would "trust" your software
to perform correctly, in all cases.
I would rather spend $69.95 (US),
and get the brand-new "Version 4" of PartitionMagic..
(See: http://www.powerquest.com/product/ for details)
rather than rely on your programming and support skills.
Avatar of vijayk

ASKER

Hi,
I understand why you wouldn't want to use my software instead of PartitionMagic. Frankly even I would prefer Partition magic :-)
But I am a developer working on a commercial product which needs to de-fragment and resize NTFS partitions. Ofcourse we could ask the user to spend another $69.95 and get PartitionMagic for doing just that but it would be nice to have it within our product itself. Sorry about rejecting your answer again...
--cheers
Rajesh Vijayakumar
How about formally "licensing" the technology from PowerQuest?
The $69.95 retail-price covers packaging and shipping and technical-support;
if you embed the software inside your package,
then the price-per-seat should significantly decrease.

Avatar of vijayk

ASKER

I wish that were possible. Unfortunately, this product will be marketed as a competitor to utilities like PartitionMagic. We have finished FAT16 and FAT32 partiton functionality and now thinking about supporting NTFS also. Hence my question.
--regards
Rajesh Vijayakumar
> this product will be marketed as a competitor to utilities like PartitionMagic.

Then, I suggest that you _FORGET_ that you ever
looked at PowerQuest's web-pages, so as to insure
yourself from any law-suits, for infringements
on their copyrights & patents.

Be careful when resizing NTFS partitions;
Version 3.04 of P.M. didn't do it correctly,
but Version 3.05 and Version 4 have fixed the problem.
(It was resized correctly, but you couldn't "boot"
from that partition, and Disk Administrator would
get quite confused -- the "old" disk vanished,
and the "new" disk has a different signature.)

Good luck in developing your product.
Because you will be the "third" company to try
to market such software, you may have a difficult time
in finding customers -- I have *NEVER* seen a customer
of Partition Magic who was even willing to "switch"
to another vendor's product.

ASKER CERTIFIED SOLUTION
Avatar of Mujeeb082598
Mujeeb082598

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of vijayk

ASKER

Hi,
This is exactly the kind of information that I was looking for. Could you please tell me where you got this information from (book or website or where ever). I need more information about how NTFS is organized so that I can manipulate the MFT and data on the file system directly.
Ofcourse you don't need to answer this to get the points. I will give them as soon as I have verified your answer.

--thanks
Rajesh Vijayakuymar
Hi :)

This information is presented in Microsoft Windows NT Workstation, Resurce Kit Version 4.0

Chapter 17 - Disk and File System Basics.
Avatar of vijayk

ASKER

Hi,
I didn't get time to verify your answer yet. So I'll just give you the points now and get back to you if i have any funther questions. Thanks for helping me with this.