NTFS

NTFS (New Technology File System) is the default file system for Windows system volumes. It has been part of Windows NT since the early 1990s and is what investigators find on almost every Windows workstation and server disk today.

NTFS treats everything, including its own structures, as files. The Master File Table ($MFT) holds a record for every file and directory, and each record is built from attributes such as $STANDARD_INFORMATION, $FILE_NAME and $DATA. Other metadata files sit at the root of the volume, hidden from normal browsing: $LogFile for transactional recovery, $Bitmap for cluster allocation, $Secure for security descriptors and, under $Extend, the change journal $UsnJrnl.

This design is a gift for forensics. Every file carries two sets of timestamps (see $STANDARD_INFORMATION vs $FILE_NAME), small files can be stored as resident data inside the MFT record itself, and features such as alternate data streams let extra content hide behind a normal file. Deleted files often remain recoverable because their MFT records are only marked as unused until they are overwritten.

The most useful NTFS artifacts on this site are the $MFT, the $UsnJrnl and the $LogFile. Parse them together: the MFT gives the current state, while the journals record how files changed over time.