My University Notes
Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Back to homepage
  1. Main Page
  2. /
  3. Cyber Security and Digital Forensics (2021-2024)
  4. /
  5. Year 2
  6. /
  7. Forensics Fundamentals
  8. /
  9. Week 2 File Systems NTFS
Edit page

Week 2 File Systems NTFS

NTFS File system

  • Created for Windows
  • Boot Signature 0x55 ⇾ 0xAA
  • NTFS created by Microsoft in 1993

Partition table

  • 16 bytes
    • 1st byte = 0x80 bootable/active, 0x00 inactive
    • 2-4th bytes = Cylinder-Head-Sector (CHS) of the first absolute sector in partition
    • 5th byte: partition type (0x0E = FAT 16; 0x0C = FAT 32; 0x07 = NTFS)
    • 6-8 bytes: CHS address of the last absolute sector in the partition
    • 9-12 bytes: Logical block addressing of the first absolute sector in the partition
    • 13-16 bytes: Number of sectors in partition

NTFS partition organization

  • Boot sector
  • Master file table
  • File system data
  • Master File table copy