2MB clusters lead to "The cluster size is 124928 bytes, but the maximum supported one is 2097152" about ntfs HOT 3 CLOSED

You can use Arsenal Image Mounter to emulate a 4Kn device for a given disk image.

from ntfs.

Thanks for the report! I confirm that this is a bug in the current code.
While tightening record and sector sizes for #2, I also looked into cluster sizes again and found https://dfir.ru/2019/04/23/ntfs-large-clusters/. That basically confirms your analysis and your PR #13.
Back then, I lacked a test image with 2 MiB clusters and Windows didn't want to format my VHD image with 2 MiB clusters. Perhaps my VHD was simply too small. Anyway, thanks for also attaching a test image so I can reproduce.
I also just stumbled upon https://github.com/msuhanov/ntfs-samples. More images for testing :)

I currently have some local changes in my code for #2 and #10 and want to finish them before I can deal with #13.

I'm also looking for NTFS filesystems with non-standard sector sizes. Windows always creates NTFS filesystems with 512-byte sectors for me. NTFS-3G has code to support other sector sizes, but Windows does not accept my NTFS-3G formatted images with non-standard sector sizes.
If you manage to create an NTFS image with an unusual sector size that is accepted by Windows, I would be highly interested :)

from ntfs.

The ntfs-samples repository looks really useful, that's a great find. I was thinking of doing basically the same thing for the test images I now have lying around (mine are far more harmless, just cluster sizes, a couple hardlinks, softlinks etc).

I'm also looking for NTFS filesystems with non-standard sector sizes

I just went down the rabbit hole of other-than-512-byte sector sizes. I also failed creating a file system that is recognized by Windows. Diving a bit deeper, it seems Windows imposes three limits on the sector size: it has to be at most the page size of the system (not sure how this interacts with large pages), be a multiple of 256, and it must match the sector size of the device.

The last requirement is the crux of the matter: every device emulates a 512 byte sector size, so that's the only value that works. Seemingly the only exception from this century are 4k native/512e drives that expose a 4096 byte sector size. It's mostly an enterprise thing, but apparently some consumer NVMe SSDs can be configured to run that way. I expect if one sets an SSD to a 4096 byte sector size and formats it with NTFS one would get a 4096 byte sector size in the BiosParameterBlock, and that would also be the only value that allows Windows to mount that file system from that disk.

I don't have any modern spare NVMe SSD lying around, so I can't readily test it in the real world.

from ntfs.