Chapter 17 - Disk and File System Basics

Archived content. No warranty is made as to technical accuracy. Content may contain URLs that were valid when originally published, but now link to sites or pages that no longer exist.

This chapter describes the organization, contents, and purpose of the information on hard disks. It contains information on the following topics:

• Disk basics.

• Volumes, partitions, volume sets, and stripe sets.

• File systems supported by Windows NT.

• Creating and formatting partitions.

• Master Boot Record.

• Partition Boot Sector.

• Using hard disks with more than 1024 cylinders.

• Using removable disks and floppy disks.

About Disks and Disk Organization

This section describes the physical structure of hard disks and floppy disks, and presents an overview of ways to logically organize areas on your disks.

Both hard disks and floppy disks work similar to an old-fashioned record player, with the record turning on the turntable and a needle playing the music. They are also similar to VCRs and stereo cassettes in that disks, cassette players, and VCRs all use a read/write head to access the information that is stored on the magnetic media.

Hard or fixed disks store information on a revolving platter of metal or glass coated with a magnetic material. The disk typically consists of several physical platters on a common spindle. This platter is similar to the record on a record player, except information is usually stored on both sides of a disk platter.

As the disk rotates, a transducer element called the head reads or writes binary data on the magnetic media. There are many methods for encoding data on the disk, such as modified frequency modulation (MFM) and run length limited (RLL). The disk controller logic determines the method used and the density of data on the disk.

Some high-end disks have as many as one head per track. Therefore, no time is lost physically moving the heads to a track in order to read information. These disks are more expensive and are normally found only on minicomputers or mainframes.

Current state-of-the-art disks do not have platters and heads, but use nonvolatile RAM (NVRAM) instead. The controller microcode organizes the memory into logical cylinders, heads, tracks, and sectors to provide a consistent interface to the operating system. Access times for these disks are measured in nanoseconds rather than the milliseconds for more conventional disks.

Hardware Terminology

Each disk consists of platters, rings on each side of each platter called tracks, and sections within each track called sectors. A sector is the smallest physical storage unit on a disk, almost always 512 bytes in size.

Figure 17.1 illustrates a hard disk with two platters. The remainder of this section describes the terms used on the figure.

 

Figure 17.1 Illustration of a hard disk 

The cylinder/head/sector notation scheme described in this section is slowly being eliminated. All new disks use some kind of translation factor to make their actual hardware layout appear as something else, mostly to work with MS-DOS and Windows 95.

Tracks and Cylinders

On hard disks, the data are stored on the disk in thin, concentric bands called tracks. There can be more than a thousand tracks on a 3½ inch hard disk. Tracks are a logical rather than physical structure, and are established when the disk is low-level formatted. Track numbers start at 0, and track 0 is the outermost track of the disk. The highest numbered track is next to the spindle. If the disk geometry is being translated, the highest numbered track would typically be 1023. Figure 17.2 shows track 0, a track in the middle of the disk, and track 1023.

A cylinder consists of the set of tracks that are at the same head position on the disk. In Figure 17.2, cylinder 0 is the four tracks at the outermost edge of the sides of the platters. If the disk has 1024 cylinders (which would be numbered 0-1023), cylinder 1023 consists of all of the tracks at the innermost edge of each side.

 

Figure 17.2 Tracks 

Most disks used in personal computers today rotate at a constant angular velocity. The tracks near the outside of the disk are less densely populated with data than the tracks near the center of the disk. Thus, a fixed amount of data can be read in a constant period of time, even though the speed of the disk surface is faster on the tracks located further away from the center of the disk.

Modern disks reserve one side of one platter for track positioning information, which is written to the disk at the factory during disk assembly. It is not available to the operating system. The disk controller uses this information to fine tune the head locations when the heads move to another location on the disk. When a side contains the track position information, that side cannot be used for data. Thus, a disk assembly containing two platters has three sides that are available for data.

Heads and Sides

A head is a small transducer that can be positioned over a disk track by using a solenoid or servomotor. The head can change the properties of the magnetic media as it rotates underneath.

A specific area can be switched to either magnetic north or south, which corresponds to a binary state of 0 or 1. This series of binary information is the data stream the disk controller passes to and receives from the operating system.

There is one head for each side of each platter. The heads are normally attached to a common head-movement mechanism, so that the heads all move in unison. The heads are always positioned at the same logical track on each side of each platter.

Because disk tracks are concentric bands, the heads must move to the track that contains the data to be accessed. The moving of the heads from the current track to the track that contains the next data is called seeking. The heads are moved over the surface of the disk in small increments called steps. Each step corresponds to one track.

Sectors and Clusters

Each track is divided into sections called sectors. A sector is the smallest physcial storage unit on the disk. The data size of a sector is always a power of two, and is almost always 512 bytes.

Each track has the same number of sectors, which means that the sectors are packed much closer together on tracks near the center of the disk. Figure 17.3, presented later in this section, shows sectors on a track. You can see that sectors closer to the spindle are closer together than those on the outside edge of the disk. The disk controller uses the sector identification information stored in the area immediately before the data in the sector to determine where the sector itself begins.

Note On Multiple Zone Recording (MZR) disks, the number of sectors on each track is not the same across the entire disk, but the hardware makes the number appear to be the same. For more information, see the section titled "Multiple Zone Recording," presented later in this chapter.

The Windows NT file systems allocate storage in clusters, where a cluster is one or more contiguous sectors. Windows NT bases the cluster size on the size of the partition.

As a file is written to the disk, the file system allocates the appropriate number of clusters to store the file's data. For example, if each cluster is 512 bytes and the file is 800 bytes, two clusters are allocated for the file. Later, if you update the file to, for example, twice its size (1600 bytes), another two clusters are allocated.

If contiguous clusters (clusters that are next to each other on the disk) are not available, the data are written elsewhere on the disk, and the file is considered to be fragmented. Fragmentation is a problem when the file system must search several different locations to find all the pieces of the file you want to read. The search causes a delay before the file is retrieved. A larger cluster size reduces the potential for fragmentation, but increases the likelihood that clusters will have unused space.

Using clusters larger than one sector reduces fragmentation, and reduces the amount of disk space needed to store the information about the used and unused areas on the disk. Because the FAT file system can use only 16 bits for the cluster number, using clusters enables FAT volumes to be larger than 65,535 sectors. There is more information about the FAT file system presented later in this chapter, and in Chapter 18, "Choosing a File System."

Figure 17.3 shows a sector on one track and the grouping of four sectors into a cluster.

 

Figure 17.3 Sectors and clusters 

Translation

Translation is the conversion of physical disk geometry (the number of cylinders on the disk, number of heads per cylinder, and sectors per track) to a logical configuration that is compatible with the operating system.

Since sector translation works between the disk itself and the system BIOS or firmware, the operating system is unaware of the actual characteristics of the disk. The disk could become inaccessible if the parameters used to set up the disk are lost, which can happen if the CMOS (described later in this section) or nonvolatile RAM (NVRAM) is corrupted or modified. In this case, the controller might translate to a configuration that adds up to the same total amount of disk space, but the operating system is not able to read data from the new arrangement. The disk has to be reformatted.

Many state-of-the-art disks now have a feature called Translation Mode. The disk controller queries the system BIOS (x86-based computers) or firmware (RISC-based computers) to determine the logical parameters the computer needs. If the number of cylinders, heads, and sectors per track the computer needs is within the range supported by the disk, the controller automatically configures itself to match those parameters. If the system BIOS or firmware does not support translation, the disk configures itself to its largest possible size, which is typically around 500 MB.

For example, all SCSI disks use some kind of translation, and many SCSI disks support hot swapping of sectors to fix bad sectors. This means that a SCSI disk maintains a set of unused sectors at the end of a disk. When a used sector goes bad, it is remapped to an unused sector and the data are written to the new sector. Windows NT uses absolute sector notation (also called logical sector notation, or LSN) for accessing disks. The translation of the sector number to the physical sector on the disk is handled by low-level disk device drivers and the hardware.

The translation is especially important when there are more than 1024 physical cylinders on the disk. The section titled "Using Hard Disks With More Than 1024 Cylinders (x86-based Computers)," presented later in this chapter, contains more details.

Multiple Zone Recording (MZR)

Some modern disks use MZR to solve the problem of wasted space on the outer tracks of the disk. The controller provides a layer of abstraction in disguising the physical layout of the sectors. The controller presents the disk to the system BIOS and the operating system as if each track had the same number of sectors per track.

MZR disks alter the operating frequency of the disk electronics, based on disk zones. Each zone is a contiguous group of cylinders. Using different frequencies means that each zone can have a different number of sectors per track. Since the zone frequency corresponds to the different data densities in each zone, the effect is to maintain a constant data density across the whole disk.

All this technology takes place entirely at the hardware level. The computer's operating system still sees the disk in the conventional logical layout of cylinders, heads, and sectors, where there is a constant number of sectors per cylinder.

When you format an MZR disk, you need to use the same parameters for sector size, tracks per cylinder, and sectors per track for all partitions.

CMOS (x86-based Computers)

The Complementary Metal Oxide Semiconductor (CMOS) chip in the computer stores information about the devices connected to the computer. When you install or change a non-SCSI disk in your computer, you need to use the BIOS setup program provided on your computer to update the information in the CMOS. (SCSI disks have their own configuration program, typically provided by the manufacturer.)

It is possible for the CMOS battery to run down if you do not turn your computer on for a long time. And the CMOS chip sometimes fails. See Chapter 21, "Troubleshooting Startup and Disk Problems," for information about identifying CMOS problems.

Logical Organization: Partitions, Volumes, Volume Set, and Stripe Sets

The Master Boot Record on each hard disk contains an area called the Partition Table that the computer uses to determine how to access the disk. It has room for four entries, called partitions, that you create to make it easier to organize information. A partition must be completely contained on one physical disk.

Use Disk Administrator to create and format partitions. The next figure is a Disk Administrator screen shot for a computer with a single disk.

 

Figure 17.4 Disk Administrator screen shot of primary partitions and an extended partition

Disk Administrator screen shows you the layout of each of your disks, including:

• The size of each disk.

• The size, label, and file system used for each partition on the disk.

• The size and location of free space.

The remainder of this section describes partitions, and explains what you see in the Figure 17.4.

There are two types of partitions in the Master Boot Record, primary and extended. A primary partition is one into which you can install the files needed to load an operating system. A primary partition is formatted for a particular file system and is assigned a drive letter. Having multiple primary partitions enables you to install and start operating systems that do not use the same file system, such as Windows NT and UNIX. There are three primary partitions in Figure 17.4: C, D, and L.

You can have one extended partition on a hard disk. An extended partition is effectively a logical disk. Unlike a primary partition, you do not format the extended partition, nor does it get assigned a drive letter. Instead, you can create one or more logical drives within the extended partition, and each logical drive is assigned a drive letter. You format each logical drive for a particular file system.

An extended partition is a method for avoiding the four-partition limit and configuring a hard disk into more than four logical areas. An extended partition entry looks much like an entry for a primary partition in the Master Boot Record, except that it points to space on the disk that can contain one or more logical drives. The important information about an extended partition is how much of the disk it takes up and where it starts.

Note In this chapter, and other chapters in the "Reliability and Recoverability" part of this book, the term logical drive means a contiguous area in an extended partition, which is assigned a drive letter.

There is an extended partition in Figure 17.4, but it is not as obvious as the primary partitions. The extended partition consists of all the disk area between primary partitions D and L. If there are logical drives on a disk, then you have an extended partition on that disk. If you have free space for which the diagonal lines look like the ones for the 4 MB of free space to the left of L, then you have an extended partition on the disk.

Figure 17.4 shows an important point. The unpartitioned space at the end of the disk (to the right of primary partition L) cannot be used. You can have only three primary partitions and one extended partition on a hard disk, or four primary partitions. This disk already has the maximum for each of these types.

Note The distinction between the two areas of free space is that the one to the left of L is free space within an extended partition, while the free space on the right of L, which has a different background pattern, is not a part of any partition.

If you have more than one primary partition or logical drive on the same disk, you can format them for different file systems. However, the format program will use the same sector size, number of tracks per cylinder, and number of sectors per track for each partition or logical drive. The cluster size can be different for each one.

The system partition is the partition on a disk that contains the hardware-specific files used in loading and initializing the operating system. Only a primary partition can be used as a system partition. Some programs, such as Disk Administrator and the MS-DOS-based program Fdisk, use the term active partition to refer to the same thing. This book uses the term system partition unless it is specifically describing dialog boxes or menus that use the term active or active partition.

The boot partition is also used in starting the operating system. It contains the operating system files and other support files needed by the operating system. Both a primary partition and a logical drive in an extended partition can be used as a boot partition. The system partition and the boot partition can be the same partition, or they can even be on different disks. Chapter 19, "What Happens When You Start Your Computer," contains more information about the system and boot partitions.

Note To summarize, you can have as many as four primary partitions on a hard disk. If you have an extended partition on the disk, you can have up to three primary partitions. If the disk does not contain the system partition, you do not need to create any primary partitions. You can use the entire hard disk as an extended partition, and create as many logical drives within it as you want to have.

Windows NT requires that the system partition be a primary partition.

Some computers create an EISA configuration partition as the first primary partition on the hard disk. On these computers, you can only have three other primary partitions on the disk, or two primary partitions and one extended partition.

You create a volume set by combining multiple areas of free space on one or more hard disks into a single logical disk. When you create a volume set, Windows NT uses the HKEY_LOCAL_MACHINE \SYSTEM \DISK Registry subkey to access the areas on the disk(s) that are part of the volume set.

A volume set can be made from:

• Free space on multiple disks.

• Multiple areas of free space on one disk.

• Multiple areas of free space on multiple disks.

You use Disk Administrator to create and extend volume sets. See Disk Administrator Help for information about creating volume sets.

Each volume set can include up to 32 areas of free space from one or more physical disks. When creating a volume set, the free space can be an unallocated area within an extended partition, or an unpartitioned area elsewhere on the disk. Figure 17.4 shows a volume set E, which is made up of two areas in the extended partition on disk 0. Figure 17.4 also shows the two different types of free space. The free space between drives E and L is unallocated space in an extended partition. The free space at the right side of the screen shot is unpartitioned space.

You cannot use volume sets to avoid the limit of four Partition Table entries for a disk. For example, the Disk Administrator screen shot in Figure 17.4 shows three primary partitions (drives C, D, and L) and one extended partition. The free space between the second part of volume set E and the primary partition L is part of the extended partition. It can be used to create one or more logical drives in the extended partition. However, the free space to the right of primary partition L is wasted disk space, because there are already three primary partitions and an extended partition.

You can tell whether free space is unallocated space in an extended partition or is unpartitioned space, because the diagonal lines go in different directions for the two types of free space.

A stripe set is composed of unpartitioned areas on from 2 to 32 disks. You use Disk Administrator to create stripe sets. The amount of space used on each disk will be equal to the smallest unpartitioned space that you selected on the disks. Like volume sets, Windows NT must use the Registry subkey HKEY_LOCAL_MACHINE \SYSTEM \DISK to know how to access the disks.

Volume is the general term that refers to all of the following entities that you can create and use on a computer running Windows NT Workstation.

• Primary partition.

• Logical drive in an extended partition.

• Volume set.

• Stripe set.

A volume has a single drive letter assigned to it, and is formatted for use by a file system.

Which Programs to Use to Create and Format Volumes

This section provides information about how to create and format volumes. You can create and format a volume in one of the following ways:

• If you have Windows NT installed on your computer, you can use Disk Administrator to create and format the volume. You can also use Disk Administrator to reformat an existing volume that is already formatted for the FAT file system or the NTFS file system. Reformatting a volume erases all information about which files used to be on the volume. You can reformat the volume as FAT or NTFS, regardless of what file system it is currently formatted for. For information about Disk Administrator procedures, see the Disk Administrator Help.

• If you want to specify special options during the format, such as a different cluster size, you can run the Format program from the command prompt. To see the options for the Format program, enter format /? at the command prompt.

• When running Windows NT, you can use the Convert program to convert an existing FAT volume to an NTFS volume, which preserves the data on the volume. For information about using the Convert program, see Chapter 22, "Disk, File System, and Backup Utilities."

• When you have started MS-DOS, you can use the fdisk command to create a primary partition or logical drive, and use the format command to format the volume for the FAT file system. See MS-DOS Help for information about these commands.

• On Alpha AXP-based computers and MIPS-based computers, you can use the Arcinst program to create and format volumes.

Note Converting a volume from the FAT file system to the NTFS file system can take a long time, depending on the amount of fragmentation and size of the FAT volume. For example, converting a 1 GB volume can take up to several hours. The conversion process has to read all of the files to build the information that NTFS needs to have about the data on the volume. When using the Convert program or converting the volume in Windows NT Setup, no status information is displayed to indicate that the conversion is proceeding. Although it looks like the conversion process is hung, it might just be taking a long time. For a large volume, it might be a good idea to run the file system conversion process overnight.

It might be faster to back up the data on the FAT volume to tape or a remote computer, reformat the volume as NTFS, and then restore the data.

If you create a single primary partition that occupies the entire disk, you cannot change the way your disk is organized without deleting the primary partition (which deletes all of the information in it) and creating new, smaller primary partitions or an extended partition. You have to back up the information that you need to save to a backup tape or a disk on a remote computer, reinstall Windows NT, and restore the data to the new volumes that you have created.

If there is no unpartitioned space left on your disk, the Create and Create Extended options on the Disk Administrator Partition menu are not available.

When you use Disk Administrator to create volumes, you have to write the changes to the Partition Table before you can format the volume. You can write the changes by using one of these methods:

• Click Commit Changes Now on the Partition menu. You can now click the volume, click the Tools menu, and click Format.

• Exiting Disk Administrator. If you have made changes to your disk configuration, Disk Administrator displays a dialog box that asks whether you want to save changes. Click Yes. You can now restart Disk Administrator, click the volume, click the Tools menu, and click Format.

If you have created a volume but not formatted it, Disk Administrator displays the volume as unformatted. You cannot access the volume in either My Computer or Windows NT Explorer until it has been formatted.

You cannot see an NTFS volume when you are running any operating system other than Windows NT. This means that your drive letters will probably be different when you are running Windows NT and other operating systems. For example, if you have two FAT volumes (C and E), and an NTFS volume (D), and you start MS-DOS, the second FAT volume will be labeled D. Because MS-DOS does not recognize the NTFS volume, the drive letter that was assigned to the NTFS volume when running Windows NT is used for the second FAT volume when running MS-DOS.

In Disk Administrator, you cannot delete the Windows NT boot partition when you are running Windows NT. You can delete the Windows NT boot partition if it is not the same primary partition as the system partition and you start another operating system that does not use the Windows NT boot partition as its boot partition.

Formatting Hard Disks and Floppy Disks

Before you can use a hard disk or a floppy disk, you must format the disk.

There are three steps to formatting a hard disk:

• Low-level formatting the hard disk.

• Creating partitions or logical drives in an extended partition.

• Doing a logical formatting of the primary partitions or logical drives.

Formatting a floppy disk is much simpler than formatting a hard disk, because there are fewer steps. You cannot create partitions on a floppy disk, so there are only two steps:

• Low-level formatting the floppy disk.

• Logical formatting of the disk.

When you format a floppy disk, the format program performs both a low-level format and a logical format, so there is really only one step. However, the low-level format on a floppy disk is not as thorough as on a hard disk.

The rest of this section discusses low-level formatting, creating primary partitions or volumes, and logical formatting. See the section "Which Programs to Use to Create and Format Volumes," presented earlier in this chapter, for more details.

Low-level Formatting

Each disk vendor provides the low-level format program to use for the disk. Consult your disk documentation or contact the vendor to find out how to do low-level formatting.

Each low-level format program determines the correct sector size to use, the number of tracks, and the number of sectors per track. This format program selects sector size based upon the disk and the information about the sectors in its circuitry. The program for almost all disks used in the United States uses a sector size of 512 bytes. The program also writes error correction and sector identification information for each sector onto the disk.

SCSI disks should always be low-level formatted when put on a new controller. The reason for this is that the translation in use on the disk varies from controller to controller, and can even vary between two identical controllers based upon the controller settings.

On x86-based computers, you must enable the BIOS on the SCSI controller if your system partition in on a SCSI disk. Depending upon your disk configuration, you might need to turn off translation in the SCSI controller. Also make sure that the CMOS has no entries for SCSI disks. For more information about the SCSI controller, see Chapter 20, "Preparing for and Performing Recovery."

There are some older IDE disks that you should not low-level format, because the factory formatting puts information on the disk that a low-level format erases. However, newer IDE disks, and all enhanced IDE disks (also known as EIDE) need to be low-level formatted. You must configure an IDE or EIDE disk in the CMOS before you can use it on the computer. See your hardware documentation for information about changing information in the CMOS.

If you have created and formatted volumes on your hard disk, but are getting errors from Chkdsk or other disk scan utilities about bad sectors on your disk, the only way to permanently eliminate them is to do a low-level format. Low-level formatting maps around the bad sectors. However, a low-level format erases all data on the disk. Therefore, be sure to back up any data on the disk before you low-level format it. You then need to create volumes (primary partitions or logical drives in an extended partition), and logically format them before you can restore the data to the disk.

Caution Do not low-level format IDE hard disks unless the manufacturer's literature describes that you should do so.

Creating Partitions on the Disk

When you create primary partitions or an extended partition on a disk, you logically divide it into one or more areas that can be formatted for use by a file system. The first partition on the disk (whether it is a primary partition or an extended partition) always starts at the outside of the disk, at cylinder 0, head 0, and sector 1. Because partition boundaries are always cylinder boundaries, the smallest partition that you can create on a disk consists of all of the tracks on a single cylinder.

When you have Windows NT installed on your computer, you should use Disk Administrator to create partitions. However, if you are setting up a new computer, you might not have any operating system. But you still need to create and format a partition into which to install Windows NT.

On x86-based computers, if you have an MS-DOS bootable floppy disk with the Fdisk program on it, you can start your computer from the MS-DOS floppy disk and create partitions by using Fdisk. On RISC-based computers, you can use the Arcinst program on the Windows NT Workstation CD to create partitions. Windows NT Setup displays an option to create a partition to use for Windows NT, provided that there is enough unpartitioned space on a hard disk.

Note On x86-based computers, you might not be able to access all your hard disk when using fdisk. If you have a disk that is larger than 4 gigabyte (GB), MS-DOS cannot see the space beyond 4 GB. Depending on the geometry, this limitation could even be 1 GB, because MS-DOS cannot access volumes that go beyond cylinder 1023. If you have more than 2 SCSI disks, MS-DOS generally does not see any disks after the first two, unless you load a SCSI device driver.

When you create the first partition on a disk (either a primary partition or an extended partition), the program that you use creates the Master Boot Record and writes it to the first sector on the disk (cylinder 0, head 0, sector 1). The Master Boot Record contains the Partition Table, which has information about each partition defined on the disk. When you make any changes to volumes on the disk, such as creating, deleting, or formatting them, the program that you are using updates the Partition Table.

You can configure the entire disk as one primary partition, and logically format it for one file system. Or you can create more than one primary partition, and use different file systems on them. You can also create an extended partition, and create one or more logical drives within the extended partition.

For more information about partitions, logical drives, and extended partitions, see "Logical Organization: Partitions, Volumes, Volume Sets, and Stripe Sets," presented earlier in this chapter. For more information about the Master Boot Record and Partition Table, see "Disk Sectors Critical to the Startup Process," presented later in this chapter.

Logical Formatting

Before you can write any data to the volume, you must do a logical format; that is, format it for use by a file system. Logical formatting writes information needed by the file system onto the disk. The information includes:

• Partition Boot Sector.

• Changing the System ID byte in the Partition Table (hard disk only).

• File system metadata, including information about available and unused space and location of files and folders.

• Damaged areas.

There is more information about each of these data in the remainder of this chapter.

When you have Windows NT installed on your computer, you should use Disk Administrator to format the partitions.

On x86-based computers, you can format primary partitions and logical drives for the FAT file system before you install any operating systems by starting the computer from a MS-DOS bootable floppy disk that has the Format program on it. You can use the Format program only for volumes that do not go beyond cylinder 1023.

On Alpha-based computers and MIPS-based computers, you can run the Arcinst program from the Windows NT Workstation CD to format the hard disk.

On both x86-based computers and RISC-based computers, you can create and format a primary partition to use for Windows NT during Setup, provided that there is enough unpartitioned space on a hard disk.

About File Systems

This section contains information about the two file systems that Windows NT supports:

• File Allocation Table (FAT). The computer can access files on a FAT primary partition or logical drive when it is running Windows NT, Windows 95, MS-DOS, or OS/2.

• Windows NT File System (NTFS). The computer must be running Windows NT to be able to access files on an NTFS volume.

With Windows NT, you can create and use long filenames as well as short filenames. Long and short filenames can be used on both NTFS or FAT volumes. A long filename can be up to 256 characters long. Short filenames are in the format xxxxxxxx.yyy, and are compatible with MS-DOS and OS/2.

Information about long and short filenames that is unique to each file system is described in the "Filenames on FAT Partitions" and "Filenames on NFTS Partitions" sections, presented later in this chapter. The section "Generating and Viewing Short Filenames," presented later in this chapter, contains general information about short filenames for both NTFS and FAT volumes.

The FAT File System

The FAT file system is a simple file system originally designed for small disks and simple folder structures. The FAT file system is named for its method of organization, the file allocation table, which resides at the beginning of the volume. To protect the volume, two copies of the table are kept, in case one becomes damaged. In addition, the file allocation tables and the root folder must be stored in a fixed location so that the files needed to start the system can be correctly located.

A volume formatted with the FAT file system is allocated in clusters. The default cluster size is determined by the size of the volume. For the FAT file system, the cluster number must fit in 16 bits and must be a power of two. The default cluster sizes are shown in the following table. You can specify a different cluster size if you format an FAT volume by using the format program from the command prompt. However, the size you specify cannot be less than that shown in the table.

Partition size	Sectors per cluster	Cluster size
0 MB - 32 MB	1	512 bytes
33 MB - 64 MB	2	1K
65 MB - 128 MB	4	2K
129 MB - 255 MB	8	4K
256 MB - 511 MB	16	8K
512 MB - 1023 MB	32	16K
1024 MB - 2047 MB	64	32K
2048 MB - 4095 MB	128	64K

The FAT file system is not recommended for volumes larger than 511 MB because of its overhead. You cannot use the FAT file system on volumes larger than 4 GB, regardless of the cluster size.

Note On volumes with the number of sectors less than 32680, the cluster sizes can be up to 8 sectors per cluster. The format program, whether you format the volume by using Disk Administrator or run format at the command prompt, creates a 12-bit FAT. Volumes less than 16 MB will usually be formatted for 12-bit FAT, but the exact size depends on the disk geometry. The disk geometry also determines the point at which a larger cluster size will be needed, because the number of clusters on the volume must fit into 16 bits. Therefore, you might have a 33 MB volume that still has only 1 sector per cluster.

Structure of a FAT Volume

Figure 17.5 illustrates how the FAT file system organizes a volume. See the section titled "Relative Sectors and Number of Sectors Fields," presented later in this chapter, for information about the area between the Partition Boot Sector and FAT1.

 

Figure 17.5 Organization of FAT volume

The file allocation table (areas FAT1 and FAT2 in Figure 17.5) contains the following types of information about each cluster on the volume:

• Unused

• Cluster in use by a file

• Bad cluster

• Last cluster in a file

The root folder contains an entry for each file and folder on the root. The only difference between the root folder and other folders is that the root folder is on a specified location on the disk and has a fixed size (512 entries for a hard disk, number of entries on a floppy disk depends on the size of the disk).

Folders have a 32-byte entry for each file and folder contained in the folder. The entry includes the following information:

• Name (eight-plus-three characters)

• Attribute byte (8 bits worth of information, described later in this section)

• Create time (24 bits)

• Create date (16 bits)

• Last access date (16 bits)

• Last modified time (16 bits)

• Last modified date (16 bits.)

• Starting cluster number in the file allocation table (16 bits)

• File size (32 bits)

There is no organization to the FAT folder structure, and files are given the first available location on the volume. The starting cluster number is the address of the first cluster used by the file. Each cluster contains a pointer to the next cluster in the file, or an indication (0xFFFF) that this cluster is the end of the file. These links and end of file indicators are shown in Figure 17.6.

 

Figure 17.6 File Allocation Table 

This illustration shows three files. The file File1.txt is a file that is large enough to use three clusters. A small file, File3.txt, fits completely in one cluster. The third file, File2.txt, is a fragmented file that also requires three clusters. In each case, the folder entry points to the first cluster of the file.

The information in the folder is used by all operating systems that support the FAT file system. In addition, Windows NT can store additional time stamps in a FAT folder entry. These time stamps show when the file was created or last accessed and are used principally by POSIX applications.

Because all entries in a folder are the same size, the attribute byte for each entry in a folder describes what kind of entry it is. One bit indicates that the entry is for a subfolder, while another bit marks the entry as a volume label. Normally, only the operating system controls the settings of these bits.

A FAT file has four attributes bits that can be turned on or off by the user — archive file, system file, hidden file, and read-only file.

Filenames on FAT Volumes

Beginning with Windows NT 3.5, files created or renamed on FAT volumes use the attribute bits to support long filenames in a way that does not interfere with how MS-DOS or OS/2 accesses the volume. Whenever a user creates a file with a long filename, Windows NT creates an eight-plus-three name for the file. In addition to this conventional entry, Windows NT creates one or more secondary folder entries for the file, one for each 13 characters in the long filename. Each of these secondary folder entries stores a corresponding part of the long filename in Unicode. Windows NT sets the volume, read-only, system, and hidden file attribute bits of the secondary folder entry to mark it as part of a long filename. MS-DOS and OS/2 generally ignore folder entries with all four of these attribute bits set, so these entries are effectively invisible to these operating systems. Instead, MS-DOS and OS/2 access the file by using the conventional eight-plus-three filename contained in the folder entry for the file.

Figure 17.7 shows all of the folder entries for the file Thequi~1.fox, which has a long name of The quick brown.fox. The long name is in Unicode, so each character in the name uses two bytes in the folder entry. The attribute field for the long name entries has the value 0x0F. The attribute field for the short name is 0x20.

 

Figure 17.7 Long filename on a FAT volume 

Note Windows NT and Windows 95 use the same algorithm to create long and short filenames. On computers that dual-boot these two operating systems, files that you create when running one of the operating systems can be accessed when running the other.

For information about how Windows NT creates the short filename, see "Generating and Viewing Short Filenames," presented later in this chapter.

By default, Windows NT versions 3.5 and higher support long filenames on FAT volumes. You can turn off creation of long filenames by setting the Win31FileSystem parameter in the following Registry entry to 1:

HKEY_LOCAL_MACHINE \System \CurrentControlSet \Control \FileSystem

Setting this value prevents Windows NT from creating new long filenames on all FAT volumes, but it does not affect existing long filenames.

Using the FAT File System with Windows NT

The FAT file system works the same in Windows NT as it does in MS-DOS, Windows 3.1x, and Windows 95. In fact, you can install Windows NT on an existing FAT primary partition or logical drive. When running Windows NT, you can move or copy files between FAT and NTFS volumes.

Note You cannot use Windows NT with any compression or partitioning software that requires disk drivers to be loaded by MS-DOS. Therefore, you cannot use MS-DOS 6.0 DoubleSpaceâ or MS-DOS 6.22 DiskSpaceä on a FAT primary partition or logical drive that you want to access when running Windows NT.

If you have a dual-boot configuration with Windows 95, you can create FAT partitions when running Windows 95 that you cannot use when running Windows NT. See the section "System ID Field," presented later in this chapter, for details.

The NTFS File System

The Windows NT file system (NTFS) provides a combination of performance, reliability, and compatibility not found in the FAT file system. It is designed to quickly perform standard file operations such as read, write, and search — and even advanced operations such as file-system recovery — on very large hard disks.

The NTFS file system includes security features required for file servers and high-end personal computers in a corporate environment. The NTFS file system also supports data access control and ownership privileges that are important for the integrity of critical data. While folders shared on a Windows NT computer are assigned particular permissions, NTFS files and folders can have permissions assigned whether they are shared or not. NTFS is the only file system on Windows NT that allows you to assign permissions to individual files. However, when you move or copy a file from an NTFS to a FAT volume, permissions and other attributes unique to the NTFS file system are lost.

The NTFS file system has a simple, yet very powerful design. Basically, everything on the volume is a file and everything in a file is an attribute, from the data attribute, to the security attribute, to the file name attribute. Every sector on an NTFS volume that is allocated belongs to some file. Even the file system metadata (information that describes the file system itself) is part of a file.

Structure of an NTFS Volume

Like the FAT file system, the NTFS file system uses clusters as the fundamental unit of disk allocation. In the NTFS file system, the default cluster size depends on the volume size. In Disk Administrator, you can specify a cluster size up to 4K. If you use the command prompt program format to format your NTFS volume, you can specify any cluster size shown in the next table.

The default cluster sizes for the NTFS file system are shown in the following table.

Partition size	Sectors per cluster	Cluster size
512 MB or less	1	512 bytes
513 MB - 1024 MB (1GB)	2	1K
1025 MB - 2048 MB (2GB)	4	2K
2049 MB - 4096 MB (4GB)	8	4K
4097 MB - 8192 MB (8GB)	16	8K
8193 MB - 16,384 MB (16GB)	32	16K
16,385 MB - 32,768 MB (32GB)	64	32K
> 32, 768 MB	128	64K

Note You cannot use NTFS compression when your cluster size is greater than 4K. See "NTFS Compression" in Chapter 18, "Choosing a File System," for more information.

Formatting a volume with the NTFS file system results in the creation of several system files and the Master File Table (MFT), which contains information about all the files and folders on the NTFS volume.

The first information on an NTFS volume is the Partition Boot Sector, which starts at sector 0 and can be up to 16 sectors long. It consists of two structures:

• The BIOS Parameter Block, which contains information on the volume layout and file system structures.

• Code that describes how to find and load the startup files for whatever operating system is being loaded. For Windows NT on x86-based computers, this code loads NTLDR.

The first file on an NTFS volume is the Master File Table (MFT). The next section of this chapter, "Master File Table and the NTFS System Files," contains more information.

The following figure illustrates the layout of an NTFS volume when formatting has finished.

 

Figure 17.8 NTFS volume layout 

Master File Table (MFT) and NTFS System Files

When you format an NTFS volume, the format program creates a set of files that contains the metadata used to implement the file system structure. The NTFS file system reserves the first 16 records in the MFT for the information about these metadata files. The NTFS file system uses approximately 1 MB for the metadata files and the first 16 records in the MFT. The next table describes these records.

System file	Filename	MFT record	Purpose of the file
Master File Table	$Mft	0	A list of all contents of the NTFS volume.
Master File Table2	$MftMirr	1	A mirror of the first three records of the MFT, used to guarantee access to the MFT in the case of a single-sector failure.
Log File	$LogFile	2	A list of transaction steps used for NTFS recoverability.
Volume	$Volume	3	The volume name, NTFS version, and other information about the volume.
Attribute Definition Table	$AttrDef	4	A table of attribute names, numbers, and descriptions.
Root Filename Index	$.	5	Root folder.
Cluster Bitmap	$Bitmap	6	A representation of the volume, showing which clusters are in use.
Partition Boot Sector	$Boot	7	The bootstrap for the volume, if this is a bootable volume.
Bad Cluster File	$BadClus	8	A location where all the bad clusters in the volume are located.
Quota Table	$Quota	9	Disk quota usage for each user on a volume. Currently unused.
Upcase Table	$Upcase	10	Used for converting lowercase characters to the matching Unicode uppercase characters.
		11-15	Reserved for future use.

The first record of the MFT describes the MFT itself, followed by the MFT mirror record. If the first MFT record is corrupted, the NTFS file system reads the second record to find the MFT mirror file, which is a copy of the first three records of the MFT. The locations of the data segments for both the MFT and the MFT mirror file are recorded in the Partition Boot Sector. A duplicate of the Partition Boot Sector is located at the end of the volume (Windows NT version 4.0) or the logical center of the volume (Windows NT version 3.51 and earlier).

The third record of the MFT is the log file, which the operating system uses to restore consistency to the NTFS file system in the event of a system crash. The log file size depends upon the volume size, and can be as large as 4 MB. The log file is discussed in more detail in the section titled "NTFS Recoverability" in Chapter 18, "Choosing a File System."

The MFT contains records that describe each file on an NTFS volume. The NTFS file system allocates space for each of the MFT records based upon the cluster size. The attributes of a file are written to the allocated space in the MFT. Small files and folders, such as the file illustrated in Figure 17.9, can be contained entirely within the MFT record.

 

Figure 17.9 MFT Record for a Small File or Folder 

Records for folders are contained within the MFT, just like records for files. All of the information for small folders reside entirely within the MFT record. Large folders are organized into B-trees, having records with pointers to external clusters containing folder entries that could not be contained within the MFT structure.

NTFS File Attributes

The NTFS file system views each file (or folder) as a set of file attributes. Elements such as the file's name, its security information, and even its data, are all file attributes. Each attribute is identified by an attribute type code and, optionally, an attribute name.

When a file's attributes can fit within the MFT file record, they are called resident attributes. For example, information such as filename and time stamp are always included in the MFT file record. When all of the information for a file is too large to fit in the MFT file record, some of its attributes are nonresident. The nonresident attributes are allocated one or more clusters of disk space elsewhere in the volume. NTFS creates the Attribute List attribute to describe the location of all of the attribute records.

Table 17.2 lists all of the file attributes currently defined by the NTFS file system. This list is extensible, meaning that other file attributes can be defined in the future.

Attribute type	Description
Standard Information	Includes time stamps, link count, and so on.
Attribute List	Lists the location of all of the attribute records when they do not all fit in the MTF record.
Filename	A repeatable attribute for both long and short filenames. The long name of the file can be up to 255 Unicode characters. The short name is the MS-DOS- readable, eight-plus-three, case-insensitive name for this file. Additional names, or hard links, required by POSIX can also be included as additional filename attributes.
Security Descriptor	Shows information about who can access the file, who owns the file, and so on.
Data	Contains file data. NTFS allows multiple data attributes per file. Each file typically has one unnamed data attribute. In addition, a file can have one or more named data attributes, using a particular syntax.
Index Root	Used to implement folders.
Index Allocation	Used to implement folders.
Volume Information	Used only in the $Volume system file and includes information such as the version and name of the volume.
Bitmap	Provides a map representing records in use on the MFT or folder.
Extended Attribute Information	Used by file servers that are linked with OS/2 systems. This attribute type isn't used by Windows NT.
Extended Attributes	Used by file servers that are linked with OS/2 systems. This attribute type isn't used by Windows NT.

Filenames on NTFS Volumes

By default, Windows NT version 3.5 and later support MS-DOS-readable filenames on all NTFS volumes. To improve performance on volumes with many long, similar names, you can disable this feature by setting the NtfsDisable8dot3NameCreation parameter of the following Registry entry to 1:

HKEY_LOCAL_MACHINE \System \CurrentControlSet \Control \FileSystem

Windows NT does not generate short (eight-plus-three) filenames for files created by POSIX-based applications on an NTFS volume. This means that MS-DOS-based and Windows-based applications cannot view these filenames if they are not valid eight-plus-three filenames. If you want to use files that are created by a POSIX application with MS-DOS-based or Windows-based applications, be sure to use standard MS-DOS eight-plus-three naming conventions.

For general information about long and short filenames for both FAT and NTFS volumes, see the section "Generating and Viewing Short Filenames," presented later in this chapter.

Using MS-DOS-based Disk Programs

Do not use any third-party MS-DOS-based disk program to repair or defragment a FAT primary partition or logical drive used by Windows NT unless the disk program has been certified as being compatible with Windows NT version 3.5 or later. While instances of third-party utilities corrupting FAT volumes are relatively rare, some problems have occurred. Using non-Windows NT utilities is simply not worth the risk of losing an entire volume. Even the MS-DOS-based program Defrag might not work correctly if you have long filenames in the FAT volume.

You can use the Windows NT command prompt program Chkdsk to scan and repair FAT and NTFS volumes. This program incorporates all of the functionality of the MS-DOS-based Chkdsk and Scandisk utilities, including a surface scan. To do a surface scan, use chkdsk /r.

There is a Windows NT–based program available that can defragment both FAT and NTFS volumes. Microsoft has a directory that contains information about hardware and software products that are available for Windows NT, including defragmentation utilities. This directory is called InfoSource. For information about InfoSource, see https://www.microsoft.com/infosource.

Disk media verification can be done with the SCSI utilities that ship with most SCSI controllers. Consult the documentation accompanying your hardware or contact your hardware vendor for information on verification of disk media. It is always a good idea to do a complete backup of the disk before starting a procedure of this type.

Generating and Viewing Short Filenames

Filenames on Windows NT platforms can be up to 256 characters, and can contain spaces, multiple periods, and special characters that are illegal in MS-DOS filenames. These long filenames use the 16-bit Unicode character set. Windows NT makes it possible to access files with long names from other operating systems by automatically generating an MS-DOS-readable (eight-plus-three) name for each file. This way, files are accessible over a network by computers using the MS-DOS, Windows 3.1x, and OS/2 operating systems, as well as by computers using Windows NT and Windows 95 operating systems.

By creating eight-plus-three filenames for files, Windows NT also enables MS-DOS-based and Windows-based 3.x applications to recognize and load files that have long filenames. In addition, when an application saves a file on a computer running Windows NT, both the eight-plus-three filename and long filename are retained.

Note Use caution with MS-DOS-based or Windows 3.x-based applications when running under Windows NT. With these applications, if you save a file to a temporary file, delete the original file, and rename the temporary file to the original filename, the long filename is lost. Any unique permissions set on that file are also lost.

If the long name of a file or folder contains spaces, be sure to surround the name with quotation marks. For instance, if you have a program called DUMP DISK FILES that you want to run from the Start icon and you enter the name without quotation marks, you will get an error message that says "cannot find the program DUMP or one of its components."

You must also use quotation marks when a path typed at the command line includes spaces, as in the following example:

move "c:\This month's reports\*.*" "c:\Last month's reports"

Use wildcards such as * and ? carefully in conjunction with the del and copy command prompt commands. Windows NT searches both long and short filenames for matches to the wildcard combination you specify, which can cause extra files to be deleted or copied.

To copy or move files with case-sensitive long filenames, it is safest to select the files using a mouse in Windows NT Explorer and My Computer. That way, you can clearly identify which files you want to copy or move.

Because both the FAT file system and the NTFS file system use the Unicode character set for their names, there are several illegal characters that MS-DOS cannot read in any filename. To generate a short MS-DOS-readable filename for a file, Windows NT deletes all of these characters from the long filename and removes any spaces. Since an MS-DOS-readable filename can have only one period, Windows NT also removes all extra periods from the filename. Next, Windows NT truncates the filename, if necessary, to six characters and appends a tilde (~) and a number. For example, each nonduplicate filename is appended with ~1. Duplicate filenames end with ~2, ~3, and so on. Filename extensions are truncated to three or fewer characters. Finally, when displaying filenames at the command line, Windows NT translates all characters in the filename and extension to uppercase.

When there are five or more files that would result in duplicate short filenames, Windows NT uses a slightly different method for creating short filenames. For the fifth and subsequent files, Windows NT:

• Uses only the first two letters of the long filename.

• Generates the next four letters of the short filename by mathematically manipulating the remaining letters of the long filename.

• Appends ~1 (or another number, if necessary, to avoid a duplicate filename) to the result.

This method provides substantially improved performance when Windows NT must create short filenames for a large number of files with similar long filenames. Windows NT uses this method to create short filenames for both FAT and NTFS volumes.

For example, these are the long and short filenames for six files that you create in the order test 1 through test 6.

Long filename	Short filename
This is test 1.txt	THISIS~1.TXT
This is test 2.txt	THISIS~2.TXT
This is test 3.txt	THISIS~3.TXT
This is test 4.txt	THISIS~4.TXT
This is test 5.txt	TH0FF9~1.TXT
This is test 6.txt	THFEF5~1.TXT

However, when you create the files in the order shown in this table, you get the following short filenames.

Long filename	Short filename
This is test 2.txt	THISIS~1.TXT
This is test 3.txt	THISIS~2.TXT
This is test 1.txt	THISIS~3.TXT
This is test 4.txt	THISIS~4.TXT
This is test 5.txt	TH0FF9~1.TXT
This is test 6.txt	THFEF5~1.TXT

Windows NT displays the long names for folders and files. You can use Windows NT Explorer and My Computer to see the short name by selecting the file or folder and selecting Properties on the File menu.

From the command line, to see both the long and short filenames for each file in the folder, type the following command:

dir /x

Tip To display both long and short filenames automatically when using the dir command, use the System option in Control Panel to set the dircmd variable to the value /x.

Disk Sectors Critical to the Startup Process

There are two sectors on every startup disk that are critical to starting the computer:

• Master Boot Record.

• Partition Boot Sector.

These sectors contain both executable code and the data required by the code. For more information about the startup process, see Chapter 19, "What Happens When You Start Your Computer." For a description of problems that you might encounter with these two sectors, see Chapter 21, "Troubleshooting Startup and Disk Problems."

Note Numbers larger than one byte are stored on x86-based computers in little endian format. For example, the sample value for the Relative Sector field in Table 17.3, 0x3F000000, is a little endian representation of 0x0000003F. The decimal equivalent of this little endian number is 63. Because most problems with the Master Boot Record and Partition Boot Sector occur on x86-based computers, the examples of these disk sectors are hexidecimal dumps from x86-based computers.

Master Boot Record

The Master Boot Record, created when you create the first partition on the hard disk, is probably the most important data structure on the disk. It is the first sector on every disk. The location is always track (cylinder) 0, side (head) 0, and sector 1.

The Master Boot Record contains the Partition Table for the disk and a small amount of executable code. On x86-based computers, the executable code examines the Partition Table, and identifies the system partition. The Master Boot Record then finds the system partition's starting location on the disk, and loads an copy of its Partition Boot Sector into memory. The Master Boot Record then transfers execution to executable code in the Partition Boot Sector.

Note Although there is a Master Boot Record on every hard disk, the executable code in the sector is used only if the disk is connected to an x86-based computer and the disk contains the system partition.

Figure 17.10 shows a hex dump of the sector containing the Master Boot Record. The figure shows the sector in two parts. The first part is the Master Boot Record, which occupies the first 446 bytes of the sector. The disk signature (FD 4E F2 14) is at the end of the Master Boot Record code. The second part is the Partition Table.

Physical Sector: Cyl 0, Side 0, Sector 1

00000000: 00 33 C0 8E D0 BC 00 7C - 8B F4 50 07 50 1F FB FC .3.....|..P.P..
00000010: BF 00 06 B9 00 01 F2 A5 - EA 1D 06 00 00 BE BE 07 ................
00000020: B3 04 80 3C 80 74 0E 80 - 3C 00 75 1C 83 C6 10 FE ...<.t..<.u.....
00000030: CB 75 EF CD 18 8B 14 8B - 4C 02 8B EE 83 C6 10 FE .u......L.......
00000040: CB 74 1A 80 3C 00 74 F4 - BE 8B 06 AC 3C 00 74 0B .t..<.t.....<.t.
00000050: 56 BB 07 00 B4 0E CD 10 - 5E EB F0 EB FE BF 05 00 V.......^.......
00000060: BB 00 7C B8 01 02 57 CD - 13 5F 73 0C 33 C0 CD 13 ..|...W.._s.3...
00000070: 4F 75 ED BE A3 06 EB D3 - BE C2 06 BF FE 7D 81 3D Ou...........}.=
00000080: 55 AA 75 C7 8B F5 EA 00 - 7C 00 00 49 6E 76 61 6C U.u.....|..Inval
00000090: 69 64 20 70 61 72 74 69 - 74 69 6F 6E 20 74 61 62 id partition tab
000000A0: 6C 65 00 45 72 72 6F 72 - 20 6C 6F 61 64 69 6E 67 le.Error loading
000000B0: 20 6F 70 65 72 61 74 69 - 6E 67 20 73 79 73 74 65 operating syste
000000C0: 6D 00 4D 69 73 73 69 6E - 67 20 6F 70 65 72 61 74 m.Missing operat
000000D0: 69 6E 67 20 73 79 73 74 - 65 6D 00 00 80 45 14 15 ing system...E..
000000E0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
000000F0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
00000100: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
00000110: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
00000120: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
00000130: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
00000140: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
00000150: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
00000160: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
00000170: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
00000180: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
00000190: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
000001A0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
000001B0: 00 00 00 00 00 00 00 00 - FD 4E F2 14 00 00 .........N......

80 01 ..
000001C0: 01 00 06 0F 7F 96 3F 00 - 00 00 51 42 06 00 00 00 .....?...QB....
000001D0: 41 97 07 0F FF 2C 90 42 - 06 00 A0 3E 06 00 00 00 A....,.B...>....
000001E0: C1 2D 05 0F FF 92 30 81 - 0C 00 A0 91 01 00 00 00 .-....0.........
000001F0: C1 93 01 0F FF A6 D0 12 - 0E 00 C0 4E 00 00 55 AA ...........N..U.

Figure 17.10 Hex Dump of the Master Boot Record for an x86-based computer 

Disk Signature

The disk signature is a unique number at offset 0x1B8 that Windows NT uses as an index to store and retrieve information about the disk in the Registry subkey HKEY_LOCAL_MACHINE \SYSTEM \DISK.

The first time that you open Disk Administrator after formatting a hard disk, it displays this dialog box to inform you that no disk signature was found on the disk. You should select Yes, or Windows NT will not be able to access the disk.

 

Viruses Can Infect the Master Boot Record

Many destructive viruses damage the Master Boot Record and make it impossible to start the computer from the hard disk. Because the code in the Master Boot Record executes before any operating system is started, no operating system can detect or recover from corruption of the Master Boot Record. You can use the DiskProbe program on Windows NT Workstation Resource Kit CD to display the Master Boot Record, and compare it to the Master Boot Record shown in Figure 17.10. There are also utilities on the Resource Kit that enable you to save and restore the Master Boot Record. See Chapter 21, "Troubleshooting Startup and Disk Problems," and Chapter 22, "Disk, File System, and Backup Utilities," for more information.

Partition Table

The information about primary partitions and an extended partition is contained in the Partition Table, a 64-byte data structure located in the same sector as the Master Boot Record (cylinder 0, head 0, sector 1). The Partition Table conforms to a standard layout that is independent of the operating system. Each Partition Table entry is 16 bytes long, making a maximum of four entries available. Each entry starts at a predetermined offset from the beginning of the sector, as follows:

• Partition 1 0x01BE (446)

• Partition 2 0x01CE (462)

• Partition 3 0x01DE (478)

• Partition 4 0x01EE (494)

The last two bytes in the sector are a signature word for the sector and are always 0x55AA.

The next figure is a printout of the Partition Table for the disk shown in Figure 17.4, presented earlier in this chapter. When there are fewer than four partitions, the remaining fields are all zeros.

80 01 ..
000001C0: 01 00 06 0F 7F 96 3F 00 - 00 00 51 42 06 00 00 00 .....?...QB....
000001D0: 41 97 07 0F FF 2C 90 42 - 06 00 A0 3E 06 00 00 00 A....,.B...>....
000001E0: C1 2D 05 0F FF 92 30 81 - 0C 00 A0 91 01 00 00 00 .-....0.........
000001F0: C1 93 01 0F FF A6 D0 12 - 0E 00 C0 4E 00 00 55 AA ...........N..U.

Figure 17.11 Partition Table from an x86-based computer 

The following table describes each entry in the Partition Table. The sample values correspond to the information for partition 1 in Figure 17.11.

Byte Offset	Field Length	Sample Value	Meaning
00	BYTE	0x80	Boot Indicator. Indicates whether the partition is the system partition. Legal values are: 00 = Do not use for booting. 80 = System partition.
01	BYTE	0x01	Starting Head.
02	6 bits	0x01	Starting Sector. Only bits 0-5 are used. Bits 6-7 are the upper two bits for the Starting Cylinder field.
03	10 bits	0x00	Starting Cylinder. This field contains the lower 8 bits of the cylinder value. Starting cylinder is thus a 10-bit number, with a maximum value of 1023.
04	BYTE	0x06	System ID. This byte defines the volume type. In Windows NT, it also indicates that a partition is part of a volume that requires the use of the HKEY_LOCAL_MACHINE \SYSTEM \DISK Registry subkey.
05	BYTE	0x0F	Ending Head.
06	6 bits	0x3F	Ending Sector. Only bits 0-5 are used. Bits 6-7 are the upper two bits for the Ending Cylinder field.
07	10 bits	0x196	Ending Cylinder. This field contains the lower 8 bits of the cylinder value. Ending cylinder is thus a 10-bit number, with a maximum value of 1023.
08	DWORD	3F 00 00 00	Relative Sector.
12	DWORD	51 42 06 00	Total Sectors.

The remainder of this section describes the uses of these fields. Definitions of the fields in the Partition Table is the same for primary partitions, extended partitions, and logical drives in extended partitions.

Boot Indicator Field

The Boot Indicator field indicates whether the volume is the system partition. On x-86-based computers, only one primary partition on the disk should have this field set. This field is used only on x86-based computers. On RISC-based computers, the NVRAM contains the information for finding the files to load.

On x86-based computers, it is possible to have different operating systems and different file systems on different volumes. For example, a computer could have MS-DOS on the first primary partition and Windows 95, UNIX, OS/2, or Windows NT on the second. You control which primary partition to use to start the computer by setting the Boot Indicator field for that partition in the Partition Table. For a description of how to set the field, see the section "Setting the System Partition," in Chapter 19, "What Happens When You Start Your Computer."

System ID Field

For primary partitions and logical drives, the System ID field describes the file system used to format the volume. Windows NT uses this field to determine what file system device drivers to load during startup. It also identifies the extended partition, if there is one defined.

These are the values for the System ID field:

Value	Meaning
0x01	12-bit FAT primary partition or logical drive. The number of sectors in the volume is fewer than 32680.
0x04	16-bit FAT primary partition or logical drive. The number of sectors is between 32680 and 65535.
0x05	Extended partition. See section titled "Logical Drives and Extended Partitions," presented later in this chapter, for more information.
0x06	BIGDOS FAT primary partition or logical drive.
0x07	NTFS primary partition or logical drive.

Figure 17.11, presented earlier in this section, has examples of a BIGDOS FAT partition, an NTFS partition, an extended partition, and a 12-bit FAT partition.

If you install Windows NT on a computer that has Windows 95 preinstalled, the FAT partitions might be shown as unknown. If you want to be able to use these partitions when running Windows NT, your only option is to delete the partitions.

OEM versions of Windows 95 support the following four partition types for FAT file systems that Windows NT cannot recognize.

Value	Meaning
0x0B	Primary Fat32 partition, using interrupt 13 (INT 13) extensions.
0x0C	Extended Fat32 partition, using INT 13 extensions.
0x0E	Extended Fat16 partition, using INT 13 extensions.
0x0F	Primary Fat16 partition, using INT 13 extensions.

When you create a volume set or a stripe set, Disk Administrator sets the high bit of the System ID field for each primary partition or logical drive that is a member of the volume. For example, a FAT primary partition or logical drive that is a member of a volume set or a stripe set has a System ID value of 0x86. An NTFS primary partition or logical drive has a System ID value of 0x87. This bit indicates that Windows NT needs to use the HKEY_LOCAL_MACHINE \SYSTEM \DISK Registry subkey to determine how the members of the volume set or stripe set relate to each other. Volumes that have the high bit set can only be accessed by Windows NT.

When a primary partition or logical drive that is a member of a volume set or a stripe set has failed due to write errors or cannot be accessed, the second most significant bit is set. The System ID byte is set to C6 in the case of a FAT volume, or C7 in the case of an NTFS volume.

Note If you start up MS-DOS, it can only access primary partitions or logical drives that have a value of 0x01, 0x04, 0x05, or 0x06 for the System ID. However, you should be able to delete volumes that have the other values. If you use a MS-DOS-based low-level disk editor, you can read and write any sector, including ones that are in NTFS volumes.

On Windows NT Server, mirror sets and stripe sets with parity also require the use of the Registry subkey HKEY_LOCAL_MACHINE \SYSTEM \DISK to determine how to access the disks.

Starting and Ending Head, Sector, and Cylinder Fields

On x86-based computers, the Starting and Ending Head, Cylinder, and Sector fields on the startup disk are very important for starting up the computer. The code in the Master Boot Record uses these fields to find and load the Partition Boot Sector.

The Ending Cylinder field in the Partition Table is ten bits long, which limits the maximum number of cylinders that can be described in the Partition Table to 1024. The Starting and Ending Head fields are one byte long, which limits this field to the range 0 – 255. The Starting and Ending Sector field is 6 bits long, limiting its range to 0 – 63. However, sectors start counting at 1 (versus 0 for the other fields), so the maximum number of sectors per track is 63.

Since current hard disks are low-level formatted with the industry standard 512-byte sector size, the maximum capacity disk that can be described by the Partition Table can be calculated as follows:

MaxCapacity = (sector size) x (sectors per track) x (cylinders) x (heads)

Substituting the maximum possible values yields:

512 x 63 x 1024 x 256 = 8,455,716,864 bytes or 7.8 GB

The maximum formatted capacity is slightly less than 8 GB.

However, the maximum cluster size that you can use for FAT volumes when running Windows NT is 64K, when using a 512 byte sector size. Therefore, the maximum size for a FAT volume is 4 GB.

If you have a dual-boot configuration with Windows 95 or MS-DOS, FAT volumes that might be accessed when using either of those operating systems are limited to 2 GB. In addition, Macintosh computers that are viewing volumes on a computer running Windows NT cannot see more than 2 GB. If you try to use a FAT volume larger than 2 GB when running MS-DOS or Windows 95, or access it from a Macintosh computer, you might get a message that there are 0 bytes available. The same limit applies to OS/2 system and boot partitions.

The maximum size of a FAT volume on a specific computer depends on the disk geometry, and the maximum values that can fit in the fields described in this section. The next table shows the typical size of a FAT volume when translation is enabled, and when it is disabled. The number of cylinders in both situations is 1024.

Translation mode	Number of heads	Sectors per track	Maximum size for system or boot partition
Disabled	64	32	1 GB
Enabled	255	63	4 GB

Note RISC-based computers do not have a limit on the size of the system or boot partitions.

If a primary partition or logical drive extends beyond cylinder 1023, all of these fields will contain the maximum values.

Relative Sectors and Number of Sectors Fields

For primary partitions, the Relative Sectors field represents the offset from the beginning of the disk to the beginning of the partition, counting by sectors. The Number of Sectors field represents the total number of sectors in the partition. For a description of these fields in extended partitions, see the section "Logical Drives and Extended Partitions," presented later in this chapter.

Windows NT uses these fields to access all partitions. When you format a partition when running Windows NT, it puts data into the Starting and Ending Cylinder, Head, and Sector fields only for backward compatibility with MS-DOS and Windows 95, and to maintain compatibility with the BIOS interrupt (INT) 13 for startup purposes.

See the section titled "Using Hard Disks With More Than 1024 Cylinders (x86-based Computers)," presented later in this chapter, for more information about the use of these fields.

Logical Drives and Extended Partitions

When more than four logical disks are required on a single physical disk, the first partition should be a primary partition. The second partition can be created as an extended partition, which can contain all the remaining unpartitioned space on the disk.

Note A primary partition is one that can be used as the system partition. If the disk does not contain a system partition, you can configure the entire disk as a single, extended partition.

Some computers create an EISA configuration partition as the first partition on the hard disk.

Windows NT detects an extended partition because the System ID byte in the Partition Table entry is set to 5. There can be only one extended partition on a hard disk.

Within the extended partition, you can create any number of logical drives. As a practical matter, the number of available drive letters is the limiting factor in the number of logical drives that you can define.

When you have an extended partition on the hard disk, the entry for that partition in the Partition Table (at the end of the Master Boot Record) points to the first disk sector in the extended partition. The first sector of each logical drive in an extended partition also has a Partition Table, which is the last 66 bytes of the sector. (The last two bytes of the sector are the end-of-sector marker.)

These are the entries in an extended Partition Table:

• The first entry is for the current logical drive.

• The second entry contains information about the next logical drive in the extended partition.

• Entries three and four are all zeroes.

This format repeats for every logical drive. The last logical drive has only its own partition entry listed. The entries for partitions 2-4 are all zeroes.

The Partition Table entry is the only information on the first side of the first cylinder of each logical drive in the extended partition. The entry for partition 1 in each Partition Table contains the starting address for data on the current logical drive. And the entry for partition 2 is the address of the sector that contains the Partition Table for the next logical drive.

The use of the Relative Sector and Total Sectors fields for logical drives in an extended partition is different than for primary partitions. For the partition 1 entry of each logical drive, the Relative Sectors field is the sector from the beginning of the logical drive that contains the Partition Boot Sector. The Total Sectors field is the number of sectors from the Partition Boot Sector to the end of the logical drive.

For the partition 2 entry, the Relative Sectors field is the offset from the beginning of the extended partition to the sector containing the Partition Table for the logical drive defined in the Partition 2 entry. The Total Sectors field is the total size of the logical drive defined in the Partition 2 entry.

Note If a logical drive is part of a volume set, the Partition Boot Sector is at the beginning of the first member of the volume set. Other members of the volume set have data where the Partition Boot Sector would normally be located.

This Disk Administrator screen shot shows a disk having an extended partition. The extended partition contains a volume set (drive E), two logical drives (drives I and K), and 4 MB of free space. This screen shot is identical to the one shown in Figure 17.4.

 

The following example is a printout from the DiskMap program of the information in the Master Boot Record (the section titled MBR) and the extended Partition Table entries (the sections titled EBR) for the disk configuration shown in the preceding Disk Administrator screen shot. For information about DiskMap, see Chapter 22, "Disk, File System, and Backup Utilities."

MBR:
Starting Ending System Relative Total
Cylinder Head Sector Cylinder Head Sector ID Sector Sectors
* 0 1 1 406 15 63 0x06 63 410193
407 0 1 812 15 63 0x07 410256 409248
813 0 1 914 15 63 0x05 819504 102816
915 0 1 934 15 63 0x01 922320 20160

EBR: (sector 819504)
Starting Ending System Relative Total
Cylinder Head Sector Cylinder Head Sector ID Sector Sectors
813 1 1 832 15 63 0x87 63 20097
833 0 1 848 15 63 0x05 20160 16128

EBR: (sector 839664)
Starting Ending System Relative Total
Cylinder Head Sector Cylinder Head Sector ID Sector Sectors
833 1 1 848 15 63 0x01 63 16065
849 0 1 872 15 63 0x05 36288 24192

EBR: (sector 855792)
Starting Ending System Relative Total
Cylinder Head Sector Cylinder Head Sector ID Sector Sectors
849 1 1 872 15 63 0x07 63 24129
873 0 1 905 15 63 0x05 60480 33264

EBR: (sector 879984)
Starting Ending System Relative Total
Cylinder Head Sector Cylinder Head Sector ID Sector Sectors
873 1 1 905 15 63 0x87 63 33201
0 0 0 0 0 0 0x00 0 0

Partition Boot Sector

The Partition Boot Sector contains information that the file system uses to access the volume. On x86-based computers, the Master Boot Record use the Partition Boot Sector on the system partition to load the operating system kernel files, or in the case of Windows NT, the boot loader.

The Windows NT Partition Boot Sector consists of:

• A jump instruction.

• The OEM name and version.

• A data structure called the BIOS Parameter Block.

• Another data structure called the extended BIOS Parameter Block.

• The bootstrap code.

The BIOS Parameter Block (bytes 11 through 35 of the Partition Boot Sector) describes physical parameters of the volume. The extended BIOS Parameter Block begins immediately after the BIOS Parameter Block. The length of this structure is different for FAT and NTFS volumes. The information in the BIOS Parameter Block and the extended BIOS Parameter Block is used by disk device drivers to read and configure volumes.

The Partition Boot Sector is the first 512-byte sector at the beginning of the volume. The sector always ends with 0x55AA, which is a sector signature word that marks the end of the sector.

FAT Partition Boot Sector

Table 17.4 describes the fields in the Partition Boot Sector for a volume formatted with the FAT file system. The sample values are the data in the corresponding fields in the hex dump in Figure 17.12, presented later in this section.

Byte Offset (in hex)	Field Length	Sample Value	Meaning
00	3 bytes	EB 3C 90	Jump instruction
03	8 bytes	MSDOS5.0	OEM Name in text
0B	25 bytes		BIOS Parameter Block
24	26 bytes		Extended BIOS Parameter Block
3E	448 bytes		Bootstrap code
1FE	2 bytes	0x55AA	End of sector marker

The following figure is a hex printout of the Partition Boot Sector for a FAT volume. The printout is formatted in three sections:

• Bytes 0 - 0x0A are the jump instruction and the OEM name.

• Bytes 0x0B - 0x3D are the BIOS Parameter Block and the Extended BIOS Parameter Block

• The rest of the printout is the bootstrap code and the end of sector marker.

Physical Sector: Cyl 0, Side 1, Sector 1 
00000000: EB 3C 90 4D 53 44 4F 53 - 35 2E 30 <.MS-DOS5.0

FakePre-81b6745ea3b74b8ab453f3e7568b8058-eed28879df064bd89f34cdd9c7ab5401

00000030: 4D 45 20 20 20 20 46 41 - 54 31 36 20 20 20 ME FAT16

33 C0 3.
00000040: 8E D0 BC 00 7C 68 C0 07 - 1F A0 10 00 F7 26 16 00 ....|h......&..
00000050: 03 06 0E 00 50 91 B8 20 - 00 F7 26 11 00 8B 1E 0B ....P.. ..&.....
00000060: 00 03 C3 48 F7 F3 03 C8 - 89 0E 08 02 68 00 10 07 ...H........h...
00000070: 33 DB 8F 06 13 02 89 1E - 15 02 0E E8 90 00 72 57 3.............rW
00000080: 33 DB 8B 0E 11 00 8B FB - 51 B9 0B 00 BE DC 01 F3 3.......Q.......
00000090: A6 59 74 05 83 C3 20 E2 - ED E3 37 26 8B 57 1A 52 .Yt... ...7&.W.R
000000A0: B8 01 00 68 00 20 07 33 - DB 0E E8 48 00 72 28 5B ...h. .3...H.r([
000000B0: 8D 36 0B 00 8D 3E 0B 02 - 1E 8F 45 02 C7 05 F5 00 .6...>....E.....
000000C0: 1E 8F 45 06 C7 45 04 0E - 01 8A 16 24 00 EA 03 00 ..E..E.....$....
000000D0: 00 20 BE 86 01 EB 03 BE - A2 01 E8 09 00 BE C1 01 . ..............
000000E0: E8 03 00 FB EB FE AC 0A - C0 74 09 B4 0E BB 07 00 .........t......
000000F0: CD 10 EB F2 C3 50 4A 4A - A0 0D 00 32 E4 F7 E2 03 .....PJJ...2....
00000100: 06 08 02 83 D2 00 A3 13 - 02 89 16 15 02 58 A2 07 .............X..
00000110: 02 A1 13 02 8B 16 15 02 - 03 06 1C 00 13 16 1E 00 ................
00000120: F7 36 18 00 FE C2 88 16 - 06 02 33 D2 F7 36 1A 00 .6........3..6..
00000130: 88 16 25 00 A3 04 02 A1 - 18 00 2A 06 06 02 40 3A ..%.......*...@:
00000140: 06 07 02 76 05 A0 07 02 - 32 E4 50 B4 02 8B 0E 04 ...v....2.P.....
00000150: 02 C0 E5 06 0A 2E 06 02 - 86 E9 8B 16 24 00 CD 13 ............$...
00000160: 0F 83 05 00 83 C4 02 F9 - CB 58 28 06 07 02 76 11 .........X(...v.
00000170: 01 06 13 02 83 16 15 02 - 00 F7 26 0B 00 03 D8 EB ..........&.....
00000180: 90 A2 07 02 F8 CB 42 4F - 4F 54 3A 20 43 6F 75 6C ......BOOT: Coul
00000190: 64 6E 27 74 20 66 69 6E - 64 20 4E 54 4C 44 52 0D dn't find NTLDR.
000001A0: 0A 00 42 4F 4F 54 3A 20 - 49 2F 4F 20 65 72 72 6F ..BOOT: I/O erro
000001B0: 72 20 72 65 61 64 69 6E - 67 20 64 69 73 6B 0D 0A r reading disk..
000001C0: 00 50 6C 65 61 73 65 20 - 69 6E 73 65 72 74 20 61 .Please insert a
000001D0: 6E 6F 74 68 65 72 20 64 - 69 73 6B 00 4E 54 4C 44 nother disk.NTLD
000001E0: 52 20 20 20 20 20 20 00 - 00 00 00 00 00 00 00 00 R .........
000001F0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 55 AA ..............U.

Figure 17.12 Partition Boot Sector for a FAT volume on x86-based computer 

Table 17.5 shows the layout of the BIOS Parameter Block and the extended BIOS Parameter Block. The sample values correspond to data in Figure17.10.

Byte Offset	Field Length	Value	Meaning
0x0B	WORD	0x0002	Bytes per Sector. The size of a hardware sector. For most disks in use in the United States, the value of this field is 512.
0x0D	BYTE	0x08	Sectors Per Cluster. The number of sectors in a cluster. The default cluster size for a volume depends on the volume size and the file system.
0x0E	WORD	0x0100	Reserved Sectors. The number of sectors from the Partition Boot Sector to the start of the first file allocation table, including the Partition Boot Sector. The minimum value is 1. If the value is greater than 1, it means that the bootstrap code is too long to fit completely in the Partition Boot Sector.
0x10	BYTE	0x02	Number of file allocation tables (FATs). The number of copies of the file allocation table on the volume. Typically, the value of this field is 2.
0x11	WORD	0x0002	Root Entries. The total number of file name entries that can be stored in the root folder of the volume. One entry is always used as a Volume Label. Files with long filenames use up multiple entries per file. Therefore, the largest number of files in the root folder is typically 511, but you will run out of entries sooner if you use long filenames.
0x13	WORD	0x0000	Small Sectors. The number of sectors on the volume if the number fits in 16 bits (65535). For volumes larger than 65536 sectors, this field has a value of 0 and the Large Sectors field is used instead.
0x15	BYTE	0xF8	Media Type. Provides information about the media being used. A value of 0xF8 indicates a hard disk.
0x16	WORD	0xC900	Sectors per file allocation table (FAT). Number of sectors occupied by each of the file allocation tables on the volume. By using this information, together with the Number of FATs and Reserved Sectors, you can compute where the root folder begins. By using the number of entries in the root folder, you can also compute where the user data area of the volume begins.
0x18	WORD	0x3F00	Sectors per Track. The apparent disk geometry in use when the disk was low-level formatted.
0x1A	WORD	0x1000	Number of Heads. The apparent disk geometry in use when the disk was low-level formatted.
0x1C	DWORD	3F 00 00 00	Hidden Sectors. Same as the Relative Sector field in the Partition Table.
0x20	DWORD	51 42 06 00	Large Sectors. If the Small Sectors field is zero, this field contains the total number of sectors in the volume. If Small Sectors is nonzero, this field contains zero..
0x24	BYTE	0x80	Physical Disk Number. This is related to the BIOS physical disk number. Floppy drives are numbered starting with 0x00 for the A disk. Physical hard disks are numbered starting with 0x80. The value is typically 0x80 for hard disks, regardless of how many physical disk drives exist, because the value is only relevant if the device is the startup disk.
0x25	BYTE	0x00	Current Head. Not used by the FAT file system. Therefore, Windows NT uses this field to store two flags: The low order bit is a dirty flag, used to indicate that Windows NT should run the Chkdsk program against the volume when it starts.  The second lowest bit indicates that a surface scan should also be run.
0x26	BYTE	0x29	Signature. Must be either 0x28 or 0x29 in order to be recognized by Windows NT.
0x27	4 bytes	CE 13 46 30	Volume Serial Number. A unique number that is created when you format the volume.
0x2B	11 bytes	NO NAME	Volume Label. This field was used to store the volume label, but the volume label is now stored as special file in the root directory.
0x36	8 bytes	FAT16	System ID. Either FAT12 or FAT16, depending on the format of the disk.

For the Media Descriptor field, the following table lists some of the recognized media descriptor values and their associated media. A media descriptor value can be associated with more than one disk capacity.

Value	Capacity	Media Size and Type
F0	2.88 MB	3.5-inch, 2-sided, 36-sector
F0	1.44 MB	3.5-inch, 2-sided, 18-sector
F9	720 KB	3.5-inch, 2-sided, 9-sector
F9	1.2 MB	5.25-inch, 2-sided, 15-sector
FD	360 KB	5.25-inch, 2-sided, 9-sector
FF	320 KB	5.25-inch, 2-sided, 8-sector
FC	180 KB	5.25-inch, 1-sided, 9-sector
FE	160 KB	5.25-inch, 1-sided, 8-sector
F8	N/A	Fixed disk

NTFS Partition Boot Sector

Table 17.6 describes the fields in the Partition Boot Sector for a volume formatted with the NTFS file system. The sample values are the data in the corresponding fields in the hex dump in Figure 17.13, presented later in this section.

Byte Offset (in hex)	Field Length	Sample Value	Meaning
00	3 bytes	EB 5B 00	Jump instruction
03	8 bytes	NTFS	OEM Identifier
0B	25 bytes		BIOS Parameter Block
24	48 bytes		Extended BIOS Parameter Block
54	426 bytes		Bootstrap code
1FE	WORD	0x55AA	End of sector marker

Note The bootstrap code for an NTFS volume is longer than the 426 bytes shown here. When you format an NTFS volume, the format program allocates the first 16 sectors for the Partition Boot Sector and the bootstrap code.

The extra data fields after the BIOS Parameter Block form an extended BIOS Parameter Block for NTFS. The data in these fields enable the boot loader to find the Master File Table (MFT) during the startup process. In the NTFS file system, the MFT is not located in a predefined sector as is the case for the file allocation table on a FAT volume. Thus, the MFT can be moved if there is a bad sector in its normal location. However, if these data are corrupt, the MFT cannot be located and Windows NT assumes the volume has not been formatted.

The following figure is a hex dump of the Partition Boot Sector for an NTFS volume (formatted when running Windows NT 4.0). The printout is formatted in three sections:

• Bytes 0 - 0x0A are the jump instruction and the OEM name.

• Bytes 0x0B - 0x53 are the BIOS Parameter Block and the Extended BIOS Parameter Block

• The rest of the printout is the bootstrap code and the end of sector marker.

Physical Sector: Cyl 407, Side 0, Sector 1 
00000000: EB 5B 90 4E 54 46 53 20 - 20 20 20 .[.NTFS 

FakePre-1161806dc30c4b66a07ed5c865050ccf-7212a8892e534ec98a4360f4eb59f740

Figure 17.13 Partition Boot Sector for a NTFS volume on an x86-based computer 

The next table describes the fields for the BIOS Parameter Block and the Extended BIOS Parameter Block. The fields starting at 0x0B, 0x0D, 0x15, 0x18, 0x1A, and 0x1C are the same as the corresponding fields for FAT volumes, as described in Table 17.5.

Byte Offset	Field Length	Sample Value	Meaning
0x0B	WORD	0x0002	Bytes per Sector.
0x0D	BYTE	0x01	Sectors per Cluster.
0x0E	WORD	0x0000	Reserved sectors.
0x10	BYTE	0x00	Always 0.
0x11	WORD	0x0000	Always 0.
0x13	WORD	0x0000	Not used by NTFS.
0x15	BYTE	0xF8	Media Type.
0x16	WORD	0x0000	Always 0.
0x18	WORD	0x3F00	Sectors per Track.
0x1A	WORD	0x1000	Number of Heads.
0x1C	DWORD	90 42 06 00	Hidden Sectors.
0x20	DWORD	00 00 00 00	Not used by NTFS.
0x24	DWORD	80 00 80 00	Not used by NTFS.
0x28	LONGLONG	A0 3E 06 00 00 00 00 00	Total Sectors.
0x30	LCN	10 00 00 00 00 00 00 00	Logical cluster number for $MFT.
0x38	LCN	51 1F 03 00 00 00 00 00	Logical cluster number for $MFTMirr.
0x40	DWORD	02 00 00 00	Clusters per file record segment.
0x44	DWORD	04 00 00 00	Clusters per index block.
0x48	LONGLONG	5B 1F DD 2C 4F DD 2C A2	Volume Serial Number.
0x50	DWORD	00 00 00 00	Checksum.

For information about the Master File Table and the $MFT and $MFTMirr files, see "Master File Table (MFT) and NTFS System Files," presented earlier in this chapter.

Using Hard Disks With More Than 1024 Cylinders (x86-based Computers)

Windows NT can take advantage of hard disks with more than 1024 cylinders if you enable extended translation. Windows NT does not have a limit to the number of cylinders it can address, but the system and boot partitions are limited to 1024 cylinders by the system BIOS, which must use INT 13 to access the disk during startup. The section "Starting and Ending Head, Sector, and Cylinder Fields," presented earlier in this chapter, contains more information about the system and boot partitions.

The following error messages might appear when extended translation is not enabled on disks larger than 1024 cylinders, and the Master Boot Record is unable to locate the Partition Boot Sector: 

• Error loading operating system.

• Missing operating system.

If you create your system and boot partitions in Windows NT Setup, you do not have to concern yourself with these details, because Setup will not create a partition that cannot be used to start Windows NT.

When Windows NT has completed startup, it does not use the values in the Starting and Ending Head, Sector, and Cylinder fields of the Partition Table. Instead, it uses the Relative Sectors and Number Of Sectors fields. These fields provide a full 32 bits to represent sectors, which results in volumes of up to 232 sectors.

With a standard sector size of 512 bytes, the 32-bit fields used for the Relative Sectors and Number of Sectors result in a maximum possible volume size of:

512 bytes x 4,294,967,296 = 2,199,023,255,552 bytes, or 2 TB.

When creating partitions or logical drives on a disk, Windows NT writes the correct values to the Partition Table fields whenever possible. When the Ending Cylinder field for an entry in the Partition Table goes beyond cylinder 1023, Windows NT writes the maximum permitted values to these fields in the Partition Table. This prevents the system BIOS from calculating the Starting and Ending addresses based on erroneous data. 

There are several Knowledge Base articles that discuss using large disks. Knowledge Base articles are included on the Windows NT Workstation Resource Kit CD.

SCSI Hard Disks

If your SCSI controller can be configured to perform translation, you can create a boot partition or system partition that is within the first 1 or 4 GB of the disk, depending upon the translation used by the controller. To create the largest possible system and boot partitions, enable translation and recreate the partitions on the disk. If translation was not already enabled, you will need to low-level format the hard disk before recreating the partitions. Check with your hardware manufacturer for specific advice and details.

Once Windows NT has been initialized, it uses its SCSI disk device drivers to directly interact with the disk without using the BIOS INT 13 interface. Therefore, the Starting and Ending Head, Sector, and Cylinder fields are not important after the computer has completed startup.

IDE and EIDE Hard Disks

The system and boot partitions on IDE hard disks are also limited to 1024 cylinders if the controller does not translate the disk address. Secondary disks that do not contain the system or boot partition might not be limited to 1024 cylinders, depending on the translation scheme used by the controller and disk.

IDE disks use a different data structure for representing the number of cylinders, number of heads, and number of sectors per track than the Partition Table and BIOS INT 13 interface. According to the IDE specifications, the maximum number of cylinders is 65536, the maximum number of heads is 16, and the maximum number of sectors per track is 255. The maximum size is 136.9 GB. Because the BIOS/IDE interface has been constrained to use the lowest common denominator, the result is a limit of about 504 MB for an IDE disk on an Intel-based ISA bus computer.

There are new controllers and disk device drivers that use an Enhanced Disk Parameter Table to translate between the logical sector layout internal to the IDE disk and the logical sector layout addressable by the BIOS INT 13 interface. These disk device drivers and devices can support larger disks. These disks and controllers are referred to as enhanced IDE, or EIDE, devices.

ESDI Hard Disks

ESDI disks are an older type that came before the IDE disks.

ESDI use the CHS (cylinder, head, sector) addressing and has a 1024 cylinder limitation. Some controller cards get around this limitation by implementing a translation scheme in the onboard controller BIOS.

The translation is totally transparent to Windows NT, and the standard disk device driver works without any change.

ESDI disks are capable of being low-level formatted with various values of sector per track, such as 53 or 63. Here are two examples:

1024 cylinders x 15 heads x 53 sectors per track x 512 bytes per sector = 398 MB

FakePre-e285c2870cfd4f2c926036692ed28cff-fbf02ddcf1214d68a6855cc5d3371eda

Thus, using 63 sectors per track yields 74 MB more space. Windows NT is compatible with either geometry, and, depending on the disk or controller, can access cylinders beyond 1023. You can use Windows NT to create and format the disk space beyond cylinder 1023, but it cannot be accessed by MS-DOS. However, some controllers can remap the remaining cylinders beyond 1023 so that either MS-DOS or Windows NT can use the entire capacity. For example:

1632 cylinders x 15 heads x 53 sectors per track x 512 bytes per sector = 634 MB

Microsoft has tested the ESDI controllers described in the following table.

Controller	Achieving Maximum Capacity
Data Technology Corp. (DTC) Model 6282-24	The maximum MS-DOS geometry is 63 sectors per track and 1024 cylinders. Windows NT can access the cylinders beyond 1023. Do not perform a low-level format on the disk using Head Mapping mode.
Data Technology Corp. (DTC) Model 6290-24	The maximum MS-DOS geometry is 63 sectors per track and 1024 cylinders. Because this controller card does not have an on-board BIOS, Windows NT cannot access the cylinders beyond 1023.
Data Technology Corp. (DTC) Model 6290 SEZ (Dual SCSI/ESDI Controller)	The maximum MS-DOS geometry is 63 sectors per track and 1024 cylinders. Windows NT can access the cylinders beyond 1023.
Data Technology Corp. (DTC) Model 6295-24	The maximum MS-DOS geometry is 63 sectors per track and 1024 cylinders. This controller card does have an on-board BIOS, so Windows NT can access the cylinders beyond 1024. Do not perform a low-level format on the disk using Head Mapping mode.
Adaptec Model 2322D	Option 1. Disable disk translation and the on-board controller BIOS. In the CMOS, use a user-defined disk type with the actual disk parameters, such as Disk Type=48, Cylinders=1632, Heads=15, Sectors per Track=53. These parameters result in a 634 MB capacity. MS-DOS is limited to the first 1024 cylinders, which makes 398 MB available. Windows NT can access beyond cylinder 1023, yielding another 236 MB. Option 2. Both MS-DOS and Windows NT can access the entire disk. Set jumpers on the controller for Disk Splitting. Disable disk translation and the on-board controller BIOS. Set up the first physical disk in CMOS as Cylinders=1024, Heads=15, Sectors per Track=53. This gives a disk capacity of 398 MB. Set up the second disk (it appears as a physical disk) in the CMOS as Cylinders=606, Heads=15, sectors per track=53. This yields another 236 MB. Windows NT sees the disk as two physical disks.
UltraStor with PROM versions < nnnn-009	The maximum MS-DOS geometry is 63 sectors per track and 1024 cylinders. Windows NT can access the cylinders beyond 1023.
UltraStor with PROM versions >= nnnn-009	The maximum MS-DOS geometry is 63 sectors per track and 1024 cylinders. Both MS-DOS and Windows NT have access to the entire disk capacity.

Using Removable Disks and Floppy Disks

Most types of removable media can work with Window NT. Even though removable media are assigned a floppy disk icon in My Computer and Windows NT Explorer, they are not handled by the same part of the operating system. Floppy disks are handled by Floppy.sys. All SCSI-based removable media are handled through the normal SCSI disk device drivers. Most magneto-optical, Bernoulli, Syquest, and similar removable-media disks are treated like hard disks under Windows NT, and do not require special disk device drivers.

You can use My Computer or Windows NT Explorer to remove media while Windows NT is running. When pointing at the device, click the right mouse button. If the media can be ejected, the Eject command is available. If there is no Eject command in the menu, or the command is grayed, you cannot eject the media.

Note WORM and other types of "Write once" media are not supported in Windows NT.

There are several limitations that are unique to removable media in Windows NT.

• Removable media can only have a single primary partition. Extended partitions are not supported.

• Removable media devices cannot be used as part of a volume set or stripe set.

• It is not possible to format a floppy disk with the NTFS file system. The Windows NT operating system formats all floppy disks with the FAT file system, because the additional files required for the NTFS file system use too much space on a floppy disk.

• If you format a removable disk with the FAT file system, you can remove the disk while Windows NT is running.

• When you format any removable disk with the NTFS file system, or if the page file is located on removable media, you must force Windows NT to unmount the disk before you can remove it. This task is necessary because the removable disk could be used, and modified, on another system. If the NTFS disk was allowed to be remounted without being closed, it is possible that the NTFS information stored in memory would no longer be accurate.

  The steps that Windows NT needs to do to unmount a removable disk include:

  • Closing all open file handles, while ensuring that no new files are opened.

  • Flushing all data, including user data and file system metadata, to the disk.

  • Unregistering the disk, so that it is no longer possible to access it.

  To unmount the disk, Windows NT has to insure that no program accesses the disk after NTFS has tried to flush the data, but before the disk is taken off line. Flushing works at shutdown, because shutdown terminates all processes that might want to write to the disk so there's nothing left running after the final flush.