A hard disk has 4 primary (MBR) partitions, all formatted as NTFS. Only one of them contains a bootable operating system (Windows XP, Windows Vista, Windows 7, Windows 8 or Windows 10). How does my bootloader program figure out which filesystem is bootable? Is it possible just by reading the boot sector (i.e. first 512 bytes) of the filesystem?
The active bit in the partition table has been lost.
Checking that byte 0 is 0xeb or 0xe9 and byte 510 is 0x55 and byte 511 is 0xAA is not enough, because even non-bootable NTFS filesystems created by the mkfs.ntfs tool on Linux pass this test, and the expected and required output for this case is non-bootable.
If my program is able to list the files in the root directory of the NTFS filesystem, which files or directories should I be looking for (NTLDR)?
If all my program has is the first 40960 bytes of the filesystem, can it still decide if the partition is bootable? (Preferably with as simple logic as possible.)
Is this correct: if files \BOOTMGR or \NTLDR exist on the NTFS filesystem, then it's (probably) bootable.
According to my best understanding, the simplest way to detect whether an NTFS filesystem contains a bootable Windows is checking that any of the files BOOTMGR or NTLDR exists in the root directory, because one of these files will be loaded by the boot code.
The NTFS boot sector (i.e. first 512 bytes of the filesystem) doesn't contain definitive information about bootability, because it can be exactly the same for bootable and nonbootable filesystems.
Some more info about Windows booting (with the role of the files BOOTMGR and NTLDR):
It's also worth looking at the source code of os-prober. In os-probes/mounted/x86/20microsoft it's indeed looking for files BOOTMGR and NTLDR (both lowercase). It also has some additional checks, like for BOOTMGR it checks the file boot/bcd and for NTLDR it checks the file ntdetect.com and boot.ini.