61. The $Boot

• Entry #7 in $MFT

• Although appears as a regular file, the non-resident $DATA attribute points to the volume boot record (VBR), located in sector zero on NTFS volume.

• Allows to bypass the file system to access the VBR without having to write special code and do the work via normal system API calls.

• There is information in the VBR that certain utilities need, like BIOS parameter block, including

  • volume serial number, and

  • cluster numbers of $MFT and $MFTMirr.

• $Boot is usually 8192 bytes long.