MFT file reference number

An MFT file reference number is how NTFS uniquely points to a file or directory. It is an 8-byte value made of two parts:

• the MFT entry number (48 bits), the index of the file's record in the $MFT;
• the sequence number (16 bits), a counter that changes each time that record is freed and reused for another file.

The combination matters because MFT entries are recycled. When a file is deleted, its entry can later be allocated to a completely different file. The entry number alone would then be ambiguous, but the sequence number tells the two apart. Tools usually display the reference as entry-sequence, for example 84211-3.

File references appear throughout NTFS metadata. Every $FILE_NAME attribute stores the reference of its parent directory, which is how full paths are rebuilt. Entries in the $UsnJrnl record both the file reference and the parent reference, and index entries in $I30 point to files the same way.

In practice this enables two useful checks. If a journal record's reference has a lower sequence number than the current MFT entry, the record describes an earlier file that has since been deleted. And when resolving the path of a deleted item, matching both entry and sequence avoids attributing activity to the wrong file. See also Master File Table (MFT).