NTFS Sectors per Cluster for 2MB cluster size

Question

Formatted a disk partition using DiskGenius for NTFS with (maximum) cluster size of 2048KB (2MB). I notice Windows itself also can format NTFS with this cluster size in Disk Management. This setting works fine with Windows 10, CHKDSK, and DiskGenius, but is unrecognizable by Linux and other partition tools (including AOMEI).

Looking the NTFS boot sector, I see 244 (hex F4) sectors per cluster recorded, with sectors being 512 bytes of course. That value, however, is too small and only indicates 122KB per cluster, which is an invalid value. Somehow, however, this is working in Windows just fine.

Is there a newer NTFS parameter block for sectors per cluster somewhere? It needs 4,096 sectors per cluster indicated to do 2MB clusters, and that value won't fit in the single byte available in the boot record.

Answer 1

Excerpt from NTFS: large clusters

Starting from Windows 10 “Redstone 3” (Fall Creators Update) [Fall 2017], it’s possible to create an NTFS volume using one of the following cluster sizes: 128K, 256K, 512K, 1M, 2M. Previously, the largest supported cluster size was 64K.

...

This update also changed the way how the “sectors per cluster” field (located in an NTFS boot sector) is treated. Previously, this was an unsigned byte and its value was treated literally. Now, this is a signed byte and its value is used as shown in the following pseudocode:

// Argument:
// - SectorsPerCluster: a signed byte (from the offset 13 in an NTFS boot sector).
// Return value:
// - A true number of sectors per cluster.
NtfsGetTrueSectorsPerCluster(SectorsPerCluster)
{
  if ((unsigned)SectorsPerCluster > 0x80)
      return 1 << -SectorsPerCluster
  else
      return (unsigned)SectorsPerCluster
}

So that does seem to explain it. The value stored for sectors per cluster is not 244, it's -12. And 2^12 is 4096, exactly what it should be for 2MB cluster size.

With this new design, they could allow the cluster size to go much larger (ExFAT allows up to 32MB clusters, for example), wonder why Microsoft decided not to allow at least that much under NTFS. Whatever, at least I found the answer and there is nothing actually corrupt in the file system as most tools will tell you, since it seems most products have still missed the announcement from 4 years ago...