Boot file

The file 7, $Boot, starts at cluster 0 of the volume. The first 0x28 bytes are the same as for FAT boot sectors, except that useless fields are zeroed. The last sector is stored in its own run, which is located in the logical center of the volume - for crash recovery.

offset(length)   contents
0(3)             Jump to boot routine
3(4)             System ID 'NTFS    '
B(2)             Sector size of volume
D(1)             Number of sectors per cluster
E(2)             Reserved Sectors, set to 0 (unused)
10(1)            Number Of FATs, set to 0 (unused)
11(2)            Root Directory, set to 0 (unused)
13(2)            Small Sectors, set to 0 (unused)
15(1)            Media descriptor (F8: hard disk)
16(2)            Sectors per FAT, set to 0 (unused)
18(2)            Sectors per track
1A(2)            Number of heads
1C(4)            Hidden Sectors (unused)
20(4)            Large Sectors, set to 0 (unused)
24(1)            Physical Drive Number
25(1)            Unused, set to 0
26(2)            Reserved, set to 80
28(8)            Number of sectors in volume
30(8)            Cluster number of the master file table ($MFT)
38(8)            Cluster number of copy of the master file table ($MFTMirr)
40(1)            Clusters per FRS
                 MFT record size in clusters, negative values indicate
                 that the MFT record is a fraction of a cluster.
44(4)            Clusters per Index Block
                 Index buffer size in clusters. Most likely, there is support
                 for negative values here, as well.
48(8)            Volume serial number
50(4)            Sector Checksum, set to 0
54(9)            Unused, set to 0
5D(1A1)          Boot routine
1FE(2)           Magic boot sector ID (AA55)
200              more code, probably NT kernel loader
last 200 bytes   copy of first 0x200 bytes