Master File Table ($MFT)

What it is

The Master File Table is the central metadata file of every NTFS volume. Each file and directory, including the NTFS system files themselves, is described by at least one FILE record, normally 1,024 bytes long. A record holds a header and a list of attributes: $STANDARD_INFORMATION ($SI), one or more $FILE_NAME ($FN), $DATA, and for directories the $I30 index attributes. Because it describes the whole volume, the $MFT is usually the first file-system artifact parsed in a case and the backbone of any file-system timeline.

Location

The first records are fixed: 0 $MFT, 1 $MFTMirr, 2 $LogFile, 3 $Volume, 5 root directory, 6 $Bitmap, 7 $Boot, 9 $Secure, 11 $Extend (which holds $UsnJrnl among others). Every attached NTFS volume, including USB drives, has its own $MFT.

What it proves

• Existence and path: a file or folder existed with this name inside this parent directory, including files that are now deleted, as long as the record has not been reused.
• Timeline: two sets of four timestamps per file (see below), plus sizes and attributes.
• Deletion: a record whose in-use flag is cleared describes a deleted file; the metadata stays readable until the record is reallocated.
• Small file contents: resident data lets you recover the full content of small files (scripts, notes, Zone.Identifier streams) straight from the record.
• Timestamp manipulation: $SI/$FN mismatches and zeroed sub-second values point to timestomping.
• It does not prove execution, who created the file, or that a user opened it. Ownership comes from $Secure:$SDS; history comes from the USN journal.

Key fields

Timestamps

Both $SI and $FN hold four FILETIME values in UTC, 100-nanosecond resolution: created, modified, record changed, accessed (MACB).

Check the access-time setting under HKLM\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate: 1 means disabled on older builds; 0x80000000–0x80000003 are the newer user/system-managed values (odd = disabled).

Retention and clearing

• The table grows but does not shrink. Freed records are reused for new files, so deleted-file metadata survives for an unpredictable time: minutes on a busy system drive, years on a quiet data volume.
• When a record is reused its sequence number increments; references in $I30 slack, the USN journal or LNK files that carry the old sequence number point to the previous file.
• Wiping tools overwrite content but often leave renamed or zeroed records behind; secure deleters such as sdelete rename files repeatedly before deleting, which shows up as bursts of rename entries in the USN journal.
• Formatting a volume creates a new $MFT; old records may still be carved from unallocated space.

Collection

• KAPE target: $MFT (also included in the FileSystem compound target)
• Velociraptor (Windows.Triage.Targets): $MFT
• Built-in: $MFT cannot be opened through the Windows API. Use a raw-NTFS tool (KAPE, Velociraptor, FTK Imager) or a disk image. Built-in commands only give live context:

fsutil fsinfo ntfsinfo C:
fsutil behavior query disablelastaccess
reg query "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v NtfsDisableLastAccessUpdate

fsutil fsinfo ntfsinfo shows the bytes per FILE record and the current $MFT size.

Parsing tools

• MFTECmd (Eric Zimmerman): MFTECmd.exe -f E:\C\$MFT --csv E:\out produces one row per record with $SI and $FN times, InUse, SI<FN, uSecZeros, Copied, SecurityId and resident Zone.Identifier contents. --de 5 dumps one record; --body writes a bodyfile; --rs recovers records from slack.
• Velociraptor: Windows.NTFS.MFT parses the live or offline table; Windows.Timeline.MFT adds anomaly flags; Windows.NTFS.Recover extracts a deleted file by record number.
• dfir_ntfs (Maxim Suhanov, open source): ntfs_parser --mft exports records to CSV; --all-mft works on a raw image.
• The Sleuth Kit: istat, fls -r and icat inspect records and recover resident or unallocated files from an image.
• Plaso: the mft parser feeds every $SI and $FN timestamp into a super timeline.

Investigation tips

• Filter on SI<FN = true and uSecZeros = true: a $SI creation time earlier than the $FN creation time, with .0000000 fractions, is the classic timestomping pattern. Confirm with the USN journal (BasicInfoChange) and $LogFile before reporting it.
• Sort by parent path and $FN created time to find everything dropped together, for example a folder of tools extracted under \ProgramData\.
• Use deleted records (InUse = false) with the parent reference to rebuild what a staging directory contained before cleanup.
• Read resident Zone.Identifier streams in the output: they reveal download origin URLs even when the browser history is gone. See Zone.Identifier.
• Parse the $I30 of key directories as well: index slack keeps names of files whose records were already reused.
• Always record the NtfsDisableLastAccessUpdate value before interpreting access times.