Volume Boot Record (VBR)#

The VBR is a 512-byte structure at sector 0 of the ReFS partition. It provides the format parameters – cluster size, version, checksum mode – that every later structure depends on. A backup copy resides in the last sector of the volume.

Field layout#

Derived values#

• Cluster size = bytes_per_sector * sectors_per_cluster
• Clusters per container (CPC) = bytes_per_container / cluster_size
  • 4 KiB clusters: CPC = 16,384
  • 64 KiB clusters: CPC = 1,024

The bytes-per-container value at 0x40 is the constant that drives virtual-to-physical address translation; without it the mount code cannot resolve virtual LCNs through the Container Table.

Version values (offset 0x28)#

Warning: The version field records mount history, not the original format version. A v3.4-formatted volume mounted on Win11 will have its version updated to 3.14.

Checksum algorithm selector (offset 0x2A)#

This field is set at format time and never modified during version upgrades. On upgraded volumes (v3.4 to v3.14), VBR 0x2A remains 0x0000 even though the driver activates CRC64 via CHKP flags. The selector records the algorithm the volume was formatted with, so on an upgraded volume it no longer describes what is on disk. The authority for the on-disk page reference format is the checkpoint’s page-reference size at CHKP+0x5C — an upgraded volume still reads 0x0000 here while its checkpoint has moved to the 48-byte CRC64 reference.

Volume flags (offset 0x2C)#

Observed composite values:

• 0x06 – v3.4
• 0x26 – v3.7 / v3.9
• 0x66 – v3.10+

VBR field classification#

Checksum algorithm#

The VBR checksum (offset 0x16) is computed by RefsIsBootSectorOurs:

checksum = 0 (u16)
for i = 3 to 511:
    if i == 0x16 or i == 0x17: skip
    checksum = (checksum >> 1) | (checksum << 15)  // rotate right 1
    checksum = (checksum + VBR[i]) & 0xFFFF
compare checksum with stored value at VBR[0x16]

Version-specific notes#

• v3.10+: Extended GUID at 0x48 is populated. On earlier versions this field is all-zero.
• Upgraded volumes: VBR 0x2A stays 0x0000, VBR flags stay 0x06, Extended GUID stays all-zero. The driver uses CHKP flags (not VBR 0x2A) as the runtime checksum indicator. Geometry extraction from the boot sector is handled by InitializeVcbFromBootSector.
• Insider build: Jump instruction at 0x00 may contain a real x86 jump (first bootable ReFS version).

Cautions#

• refsutil fixboot is destructive: it zeroes the container size, volume serial, checksum algorithm selector, Extended GUID, and volume flags fields.
• The VBR version field reflects mount history, not original format version. Cross-check with the superblock or checkpoint for provenance.

Raw example#

From a v3.14 image, the VBR at the partition start (byte offset 0x1000000):

0x00:  00 00 00 52 65 46 53 00  00 00 00 00 00 00 00 00   |...ReFS.........|
0x10:  46 53 52 53 00 02 b2 7a  00 00 7e 00 00 00 00 00   |FSRS......~.....|
0x20:  00 02 00 00 08 00 00 00  03 0e 02 00 66 00 00 00   |............f...|
0x30:  00 00 00 00 00 00 00 00  44 99 a9 5a a6 a9 5a 00   |........D..Z..Z.|
0x40:  00 00 00 04 00 00 00 00  00 b2 8e 59 d7 ab 80 45   |...........Y...E|

Cross-references#

• Superblock (SUPB) – located at cluster 30; VBR points to it via fixed offset
• Checkpoint (CHKP) – SUPB stores pointers to two alternating checkpoints
• Page References – format depends on VBR checksum algorithm selector
• Container Table – the bytes-per-container constant feeds VLCN to PLCN translation

An encrypted volume shows a different signature#

When BitLocker encrypts the volume, the ReFS signature at +0x03 is replaced by the FVE marker -FVE-FS-. A reader that keys on the ReFS signature alone will call such a volume unrecognised rather than encrypted; the distinction matters, because one means “not this filesystem” and the other means “this filesystem, behind a lock”. Measured on format 3.14.

Evidence#

The field layout, signatures, and checksum loop are confirmed by the string literals and the decompiled driver – RefsIsBootSectorOurs validates the boot sector and computes the 0x16 checksum, and InitializeVcbFromBootSector extracts the geometry; the field values, the immutable format-time fields on upgrade, and the refsutil fixboot effects are raw-disk verified across the corpus. The custom CRC64 polynomial (not ECMA-182) is confirmed. Also registered for statements on this page:. The BitLocker -FVE-FS- marker replacing the signature at +0x03 is confirmed.

The remaining field-level statements on this page are registered as — each with its own evidence tier and witness in the claim register.