Concept - Fixup

Overview

The smallest unit of disk space that NTFS uses is a Cluster. This can vary from one sector to 128 sectors, the usual number is 8 (4KB). Naturally this is dependent on the sector and Cluster. sizes declared in $Boot.

Because a single sector could fail, it's important for NTFS to be able to detect errors in a cluster. For this purpose the sectors have Fixups, which are kept in an Update Sequence Array.

Many important Metadata Records use fixups to protect data integrity

• FILE Records in the $MFT
• INDX Records in directories and other indexes
• RCRD Records in the $LogFile
• RSTR Records in the $LogFile

What Does It Do?

The header of each of these records contains a Update Sequence Number and a buffer. The last two bytes of each sector of the record are copied into the buffer and the Update Sequence Number is written in their place.

When the record is read, the Update Sequence Number is read from the header and compared against the last two bytes of each sector. If it succeeds, then it copies the bytes in the buffer back to their original places.

Example

Here's an example before the fixup is applied, with a cluster size of 2KB (4 Sectors).

Here the Update Sequence Number is 0xABCD and the Update Sequence Array is still empty.

The last two bytes of each sector have been copied into the Update Sequence Array, and the Update Sequence Number has been written over the last two bytes of each sector.

The Details

Writing

Before writing a fixup-protected record:

1. Add one to the Update Sequence Number (0x0000 must be skipped)
2. For each sector, copy the last two bytes into the Update Sequence Array
3. Write the new Update Sequence Number to the end of each sector
4. Write the record to disk

Reading

When reading a fixup-protected record:

1. Read the record from disk
2. Check the magic number is correct
3. Read the Update Sequence Number
4. Compare it against the last two bytes of every sector
5. Copy the contents of the Update Sequence Array to the correct places

If any of the checks fail when reading, it could mean there is: a bad sector, disk corruption or a fault in the driver.