1 (edited by aviyi 2020-09-20 20:26:31)

Topic: Reserved fields aren't zero

Hello everybody!

I'm fixing the damage boot sector and a NTFS logical partition of a 500 GB hard drive, editing it with DMDE 3.6.0 Free Edition, and following GParted 0.32.0's warnings as a guide. The warning messages I've got so far are:

  • Unexpected bytes per sector value (58953).

  • Unexpected sectors per cluster value (53).

  • Reserved fields aren't zero (52950, 61259, 37363, 62786, -1592644716, 26).

The first two are already solved (512 bytes per sector and 8 sectors per cluster), but I've been unable to fix the third one because I'm not sure what does it mean: are those "reserved fields" just reserved sectors located in the offset 0x0E? are all those unused data streams located in many offsets (0x10, 0x13, 0x16, 0x20, 0x24, 0x41, and 0x45) which are supposed to have zero or null like values?.

GParted only mention six numbers not seven, and one is a negative value, so my guess is those are not block offsets.

2

Re: Reserved fields aren't zero

It seems that the partition boot record is damaged/corrupted.
This web page can be helpful. Some of those bytes aren't used and have to be zero.
What the command chkdsk reports? chkdsk is among the "official" checking tools for the ntfs.
Did you try to use Testdisk to analyse and eventually repair the partition? It is contained in the GParted Livecd.

*** It is highly recommended to backup any important files before doing resize/move operations. ***

3 (edited by aviyi 2020-09-17 07:46:39)

Re: Reserved fields aren't zero

class413 wrote:

It seems that the partition boot record is damaged/corrupted.
This web page can be helpful. Some of those bytes aren't used and have to be zero.

I've been reading these days that NTFS wiki page along to the NTFS Documentation of the Linux-NTFS Project, very insightful so thanks for the advice.

class413 wrote:

Some of those bytes aren't used and have to be zero.

According to their offset I need to know: Which bytes are those? What is suppose to be their size?

class413 wrote:

What the command chkdsk reports? chkdsk is among the "official" checking tools for the ntfs.

Windows 7 is unable to see that partition so chkdsk is still useless.

class413 wrote:

Did you try to use Testdisk to analyse and eventually repair the partition? It is contained in the GParted Livecd.

TestDisk is the tool that let me recover something of the Master File Table backup (along with the Master Boot Sector) but gave me a RAW logical partition (which should have been an NTFS logical partition), now after editing it with DMDE is marked as NTFS on GParted.