Analogous to the BIOS Parameter Block (BPB) governing FAT-based volumes, the NTFS Partition Boot sector functions as the authoritative descriptor of the volume's on-disk architecture. Encoded within it are the foundational structural parameters: sectors-per-cluster (establishing cluster granularity); the signed-byte encoding governing File Record Segment size; and, most consequentially, the Logical Cluster Number (LCN) denoting the starting address of the Master File Table. This indirection is not a forensic accommodation but a consequence of NTFS's design philosophy, which avoids hardcoding structural offsets, permitting $MFT placement to be optimized at format time and, per documented Microsoft behavior, relocated should bad clusters be detected within the MFT zone. Notably, the boot sector resolves only the LCN of the base MFT record; where the $MFT is fragmented, subsequent extents are recoverable solely via parsing that record's own $DATA attribute run list—a distinction germane to any rigorous reconstruction of MFT allocation topology.
The NTFS Partition Boot Sector
On an NTFS-formatted volume, the Partition Boot Sector resides at logical sector 0 and constitutes the $Boot metadata file (file record #7), spanning the first 16 sectors. Sector 0 houses the core boot record, including the jump instruction, OEM identifier, and the critical BIOS Parameter Block (BPB) along with its extended fields. Sectors 1 through 15 contain the remaining bootstrap code and ancillary boot structures. For enhanced fault tolerance, NTFS maintains a duplicate copy of the boot sector at the final logical sector of the partition (or near the logical center in legacy implementations)—a redundancy measure examiners can also exploit for forensic recovery when the primary boot sector is corrupted or unreadable.
The BPB and extended BPB furnish indispensable filesystem geometry parameters, notably the MFT record size (in bytes or clusters per File Record Segment) and the Logical Cluster Number (LCN) of the $MFT's starting location. These values are paramount during forensic examinations, as they enable accurate parsing of the Master File Table, proper reconstruction of filesystem timelines, and reliable interpretation of MFT records even in the presence of fragmentation or partial damage. The hexadecimal dump below illustrates the boot sector structure.
 |
| Figure 1: Hexadecimal dump of the NTFS boot sector |
It should be emphasized that all multi-byte values within the NTFS boot sector are stored in little-endian byte order. Accurate parsing during forensic analysis therefore requires appropriate endianness conversion (byte reversal) when interpreting these fields on big-endian architectures or within manual hex viewers. The table below delineates the structural layout of the BIOS Parameter Block (BPB) and its extended fields, commencing at byte offset 0x0B relative to the start of the Partition Boot Sector ($Boot).
|
Byte Offset |
Length |
Description |
|
0x0B |
WORD |
Number of bytes per sector, usually 512 |
|
0x0D |
BYTE |
Number of sectors per cluster |
|
0x0E |
WORD |
Number of reserved sectors, usually 0 |
|
0x10 |
3 BYTES |
Always 0 |
|
0x13 |
WORD |
Not used by NTFS |
|
0x15 |
BYTE |
Media descriptor. The type of media on which the file system is resident. This is generally 0xF8 for standard hard drives. |
|
0x16 |
WORD |
Always 0 |
|
0x18 |
WORD |
Sectors per track (used by BIOS, not critical for NTFS). This value is related to the old format CHS addressing in disks |
|
0x1A |
WORD |
Number of heads (used by BIOS, not critical for NTFS). This value is related to the old format CHS addressing |
|
0x1C |
DWORD |
Hidden sectors. Number of sectors before the start of the partition. Meaning uncertain. |
|
0x20 |
DWORD |
Not used by NTFS |
|
0x24 |
DWORD |
Not used by NTFS |
|
0x28 |
LONGLONG |
Total sectors |
|
0x30 |
LONGLONG |
Logical Cluster Number (LCN) for the file $MFT |
|
0x38 |
LONGLONG |
Logical Cluster Number (LCN) for the file $MFTMirr |
|
0x40 * |
BYTE |
Size of the MFT record in clusters, usually 1024. A two’s complement number. A positive number represents the MFT record size in bytes. In the case of a negative number, x, the MFT record size is given by 2|x| bytes. |
|
0x41 |
3 BYTES |
Not used |
|
0x44 * |
BYTE |
Size of index buffer, INDX file, in clusters. |
|
0x45 |
3 BYTES |
Not used |
|
0x48 |
LONGLONG |
Volume Serial Number |
|
0x50 |
DWORD |
Not used |
The two fields annotated with asterisks (*) at offsets 0x40 and 0x44 in the BPB are signed 8-bit integers that support dual interpretive modes. When the value resides in the positive range (0x00–0x7F), it specifies the number of clusters per MFT record (or index buffer for INDX records). Conversely, when the value falls in the negative range (0x80–0xFF), it denotes the size of each MFT record (or INDX buffer) expressed in bytes.
The effective size is computed by raising 2 to the power of the absolute value of the signed byte. For example, as commonly observed in the sample BPB (byte offset 0x40 containing 0xF6), the signed interpretation yields –10. The absolute value is therefore 10, and because the original value is negative, each MFT record comprises 2¹⁰ = 1024 bytes. This 1 KB MFT record size represents the de facto standard across modern Windows implementations and is of significant forensic importance for correct MFT parsing and record boundary alignment.
Consistent with other filesystems such as FAT, NTFS employs clusters as the fundamental unit of disk space allocation. Each cluster consists of a fixed number of sectors—typically a power of two—and cluster numbering commences at zero from the start of the volume. In NTFS, these are formally designated as Logical Cluster Numbers (LCNs). File data runs are described within the corresponding MFT record using Virtual Cluster Numbers (VCNs). VCNs begin at 0 and increment sequentially for each cluster allocated to the file, providing a file-relative view of its data allocation. In contrast, an LCN represents the absolute offset of a cluster from the beginning of the volume.
Thus, while both LCNs and VCNs originate at zero, the former denotes a global volume position and the latter a file-specific position. The figure below illustrates a representative non-contiguous file occupying three clusters (LCNs 1355, 1588, and 2033), along with the corresponding VCN-to-LCN mapping stored in the file’s data attribute runlist within the Master File Table.
You can use the TSK mmls command to discover the layout of your forensic image. With the mmls command, we can determine where the partition of interest starts.
In the provided forensic image, a single NTFS partition is clearly discernible. Its boundaries are delineated by a starting sector of 97 and a terminating sector of 248319, yielding a partition size of 248223 sectors (calculated as end sector – start sector + 1).
To facilitate targeted analysis of the NTFS volume, the partition can be extracted from the parent disk image using the dcfldd utility with the following syntax:
Extract the boot sector from the resultant NTFS partition as follows.
Locating the Master File Table (MFT) In An NTFS Volume
The Master File Table ($MFT) constitutes the cornerstone of the NTFS filesystem, serving as the central repository for all file and directory metadata. Accurate determination of its location is therefore essential for any forensic examination.
The starting address of the $MFT is stored in the BIOS Parameter Block (BPB) of the Partition Boot Sector ($Boot). Specifically, the 64-bit Logical Cluster Number (LCN) of the $MFT is located at byte offsets 0x30–0x37 (little-endian). In the current example, this value corresponds to LCN 10342.
The BPB further indicates at byte offset 0x0D that each cluster comprises 8 sectors. The absolute starting sector of the $MFT is computed using the following formula:
MFT sector = MFT_LCN × sectors_per_cluster
= 10342 x 8
= 82,736Thus, the $MFT begins at sector 82,736 of the volume.
As expected, the $MFT is itself described by the first MFT record (record #0). The actual size of the $MFT file is specified within the $Data attribute header of this record, allowing forensic tools to determine the full extent of the metadata database.
Determining the Address of the Cluster Which Contains a Given MFT Entry
Effective forensic analysis of an NTFS volume requires the ability to locate and parse individual Master File Table (MFT) records efficiently. Since MFT entries are not necessarily contiguous in memory and the $MFT** can span multiple clusters, examiners must calculate the precise cluster address for any given MFT entry.
The starting cluster of the $MFT** is obtained from the BIOS Parameter Block (BPB) at byte offsets 0x30–0x37 (64-bit little-endian value). Given that standard MFT records are fixed at 1 KB (1024 bytes) and the cluster size is known (typically a multiple of 512 bytes), the cluster C containing a specific MFT entry can be derived using the following formula:
C = MFT_LCN + floor(MFT_entry_number / (Cluster_Size_in_bytes / 1024))
Where:
- MFT_LCN = Starting Logical Cluster Number of the $MFT (from the BPB)
- MFT_entry_number = The target MFT record index (e.g., 0 for $MFT itself, 5 for the root directory, etc.)
- Cluster_Size_in_bytes = Size of one cluster in bytes (derived from sectors-per-cluster × bytes-per-sector)
- floor() = Floor function (integer division discarding the remainder)
This computation enables precise navigation to the cluster housing any MFT entry, which is fundamental for manual MFT parsing, timeline reconstruction, deleted file recovery, and targeted carving during digital forensic investigations.
For example, the file canada.txt is represented by MFT entry 35. Given that the $MFT begins at MFT_LCN = 10,342 and the cluster size is 4 KB (4096 bytes), each cluster accommodates exactly 4 MFT records (4096 ÷ 1024 = 4). Applying the formula:
C = 10,342 + floor(35 / 4) = 10,342 + 8 = 10,350Thus, MFT entry 35 resides in cluster 10,350. Specifically, it occupies the final 1 KB (1024-byte) slot within that cluster (i.e., byte offset 3072–4095 relative to the start of the cluster). This aligns with the initial population of the $MFT: the first cluster (LCN 10,342) contains the first four system metadata files—MFT entry 0 ($MFT), entry 1 ($MFTMirr), entry 2 ($LogFile), and entry 3 ($Volume)—illustrating the predictable, sequential layout of early MFT records.
Post a Comment