Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

Bytes Offset for $BadClus of NTFS partition

32 views
Skip to first unread message

Anthony Vanover

unread,
Jan 14, 2012, 6:20:13 PM1/14/12
to
There are 512 bytes per sector, the MBR exists on the 1st sector,
sectors 2 - 4 are 0-filled (future use?), and the first partition is
on the 5th sector. We're going to assume the 1st partition is NTFS.
From now on, the "1st sector" will be considered the "1st sector of
the NTFS partition i.e. 5th sector". Sequential sectors logically
follow in a similar manner.

First off, there are several "SYSTEM FILES" of NTFS: http://pastebin.com/QNUiNU2r

The 1st sector begins with $Boot. $Boot is 16 sectors long. The 1st
sector contains the VBR (Volume Boot Record), sectors 2 - 15 contains
the IPL (Initial Program Loader). That is to say that $Boot extends to
byte offset 8192 (0x2000, 020000).

Boot Sector: http://pastebin.com/wutMpPh3
BPB & Extended BPB: http://pastebin.com/emWWCxuV

So, know that you know what I know, what is the byte offset for the
other SYSTEM FILES? I'm especially interested in $BadClus. Thank you
for taking the time to read and respond.
0 new messages