1

Distantly related: What is the function of c:\BOOT. This is the "boot" folder, where the BCD and other boot data is stored, not a file.

Running either of these commands yields information on the location of the file (on disk), its size, attributes, etc.:

fsutil volume filelayout C:\$MFT
fsutil file queryextents C:\$MFT

However, attempting to do so on the $Boot file in the same directory yields:

Error:  Access is denied.

Even running as Administrator. What is the purpose of this file, what are its contents, and how can I find out where it is stored on disk?

I'm attempting to validate claims that:

When you format an NTFS volume, the format program allocates the first 16 sectors for the $Boot metadata file

and

For Windows the PBR loads an additional 16 sectors from the beginning of the partition. These sectors constitute the first stage of the Windows boot loader which in turn loads one of two files depending on the version of Window

The reason I ask is that I thought the PBR was a single sector before a partition (on an MBR formatted disk), which is followed by the main data storage (formatted as whatever File-System you want).

1

I ran a few more commands (that I should have tested earlier), and found that the first 2 clusters are used by the $Boot file. My PC has 4 KiB clusters, and sectors are 512 bytes so this does indeed confirm that the first 16 sectors are reserved for the $Boot file.

C:\windows\system32>fsutil volume querycluster c: 1 0
Cluster 0x0000000000000000 used by -S--D \$Boot::$DATA
Cluster 0x0000000000000001 used by -S--D \$Boot::$DATA

Here is a HEX dump of the first 2 sectors:

Hex Dump

The first block here corresponds to the Partition Boot Sector, which you can read more about online, but essentially just loads NTLDR or bootmgr, depending on your version of Windows.

  • This doesn't actually answer your question ... – DavidPostill Mar 22 at 1:44
  • Yeah, I was going to make this an update, but I figured I'd make it an answer, since it does answer one part: "I'm attempting to validate claims..." – Addison Mar 22 at 1:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.