Resident data

Resident data is the content of an NTFS attribute stored directly inside the file's record in the $MFT, rather than in clusters elsewhere on the volume. Each MFT record is small (commonly 1,024 bytes), so only small files and small alternate data streams fit after the record's headers and other attributes. Larger content is stored non-resident: the attribute then holds a list of data runs pointing to clusters on disk.

This has several forensic consequences:

• The contents of small files, such as short scripts, configuration snippets or Zone.Identifier streams, can be recovered from the MFT alone, even without the rest of the disk image.
• When a small file is deleted, its record is marked as unused but not wiped, so the resident content often survives until the record is reused. MFT parsers and carving tools can extract it.
• Because resident content never occupies its own clusters, it will not be found by carving unallocated space; it has to be recovered from the MFT itself.

Resident status is not permanent. If a file grows beyond what fits in the record, NTFS moves its content out to clusters and the attribute becomes non-resident. Remember this when explaining why some deleted files are fully recoverable while others are not. See also NTFS and Master File Table (MFT).