Boot file

The file 7, $Boot, starts at cluster 0 of the volume. The first 0x28 bytes are the same as for FAT boot sectors, except that useless fields are zeroed. The last sector is stored in its own run, which is located in the logical center of the volume - for crash recovery.

    offset(length)   contents
    0(3)             Jump to boot routine
    3(4)             System ID 'NTFS    '
    B(2)             Sector size of volume
    D(1)             Number of sectors per cluster
    E(7)             unused, zero filled
    15(1)            Media descriptor (f8: hard disk)
    16(2)            unused, zero filled
    18(2)            Sectors per track
    1A(2)            Number of heads
    1C(8)            unused, zero filled
    24(2)            ?unknown, set to 80
    26(2)            ?unknown, set to 80
    28(8)            Number of clusters in volume
    30(8)            Cluster number of the master file table ($MFT)
    38(8)            Cluster number of copy of the master file table ($MFTMirr)
    40(4)            MFT record size in clusters
    44(4)            Index buffer size in clusters
    48(4)            Volume serial number
    4C(4)            ?
    50(D)            unused, zero filled
    5D(1A1)          Boot routine
    1FE(2)           Magic boot sector ID (AA55)
    200              more code, probably NT kernel loader
    last 200 bytes   copy of first 0x200 bytes