template "Boot Sector NTFS"

// Template by Paul Mullen, pcguru@the-answer.com
// last modified Jul 16, 2000

// To be applied to sector 0 of an NTFS-formatted
// logical drive or to the mirror copy of the boot
// sector, which will be located near the end of
// the partition.
// See Microsoft KB article Q153973, "Recovering NTFS boot Sector"
// http://support.microsoft.com/support/kb/articles/Q153/9/73.asp

description "Boot sector of an NTFS partition"
applies_to disk
sector-aligned

requires 0x00	"EB" 					// bytes 0 to 2 are
requires 0x02	"90"					// JMP instruction
requires 0x03	"4E 54 46 53 20"	// ID must be "NTFS"
requires 0x1FE	"55 AA"				// "magic" signature

begin
	read-only hex 3	"JMP instruction"			//00
	char[8]				"SystemID"					//03
	uint16				"Bytes per sector"		//0B
	uint8					"Sectors per cluster"	//0D
	uint16				"Reserved sectors"		//0E
	hex 3					"(always zero)"			//10
	read-only hex 2	"(unused)"					//13 
	hex 1					"Media descriptor"		//15
	read-only hex 2	"(unused)"					//16
	uint16				"Sectors per track"		//18
	uint16				"Heads"						//1A
	uint32				"Hidden Sectors"			//1C
	read-only hex 4	"(unused)"					//20
	read-only hex 4	"(always 80 00 80 00)"	//24
	int64					"Total sectors"			//28
	move -8 
	hex 8					"Total sectors (hex)"	//28
	int64					"Start C# $MFT"			//30
	int64					"Start C# $MFTMirr"		//38
	uint32				"Clust per MFT rec"		//40
	uint32				"Clust per index block"	//44
	uint32				"Serial number (int)"	//48
	move -4
	hex 4					"Serial number (hex)"	//48
	goto 0x1FE			//boot load code follows
	read-only hex 2	"Signature (55 AA)"		//1FE
end