Glossary
Master File Table (MFT)
The NTFS metadata index, stored as `$MFT`, holding one record per file and directory on a volume.
The Master File Table is the heart of an NTFS volume: a database, stored in the file $MFT, that contains at least one record for every file and directory present. If something exists on the volume, it has an entry here, which makes the MFT a primary source for forensic timelines and for recovering traces of deleted files.
Each record is normally 1024 bytes and is built from a set of attributes such as $STANDARD_INFORMATION, $FILE_NAME, and $DATA. When a file's content is small enough to fit inside the record, it is stored resident directly in the $DATA attribute rather than in separate clusters, so the file's data and metadata live together.
Because the MFT records both metadata and small file contents, analysts parse it to extract names, sizes, timestamps, and parent directories without mounting the file system.
See also MACB Timestamps.
Related artifacts
- $Secure:$SDS security descriptors$Secure:$SDS cheat sheet: NTFS security descriptor store, $SDH and $SII indexes, Security ID in $SI, file owner SID and ACLs, collection and MFTECmd.
- Master File Table ($MFT)$MFT cheat sheet: FILE records, $SI vs $FN timestamps, resident data, deleted records, sequence numbers, timestomping checks and MFTECmd parsing.