01Location
- <NTFS volume>\$MFT (MFT entry 0)
- <NTFS volume>\$MFTMirr (MFT entry 1, copy of the first four entries)
02Questions it answers
- Which files and directories exist or existed (unallocated entries not yet reused)?
- What is the full path of a file, rebuilt through parent references?
- What are the four $STANDARD_INFORMATION and four $FILE_NAME timestamps?
- Does a file have hard links or named data streams?
03Format and versions
| Format | Array of MFT entries, commonly 1024 bytes (size defined in the volume header), each with a 'FILE' signature, fix-up values and attributes. A file reference is a 48-bit entry index plus a 16-bit sequence number. $STANDARD_INFORMATION is 48 or 72 bytes; $FILE_NAME is variable and stores a UTF-16LE name. |
|---|---|
| Applies to | All NTFS volumes used by Windows; libfsntfs notes structural differences for NT4 (NTFS 1.2). |
04Key fields
| Field | What it tells you |
|---|---|
| Entry header | Signature, $LogFile sequence number (LSN), sequence number, link count, flags (in use, directory), base record reference. |
| $STANDARD_INFORMATION | Creation, modification, MFT entry modification and last access times; attribute flags; security identifier; USN. |
| $FILE_NAME | Parent file reference, four timestamps, allocated and data sizes, namespace and name; one per name or hard link. |
| $DATA | Resident data or data runs; named $DATA attributes are alternate data streams. |
| $ATTRIBUTE_LIST | References to attributes stored in other MFT entries. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| $STANDARD_INFORMATION C / M / E / A | FILETIME (UTC) | Creation, last modification, MFT entry modification and last access. |
| $FILE_NAME C / M / E / A | FILETIME (UTC) | The same four times kept separately in each $FILE_NAME attribute. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Extract $MFT (and $MFTMirr) from the image without mounting the volume read-write.
- Parse all entries, including those not marked in use.
- Rebuild paths from parent references, checking sequence numbers to avoid linking to reused entries.
- Compare $STANDARD_INFORMATION and $FILE_NAME times and correlate with $UsnJrnl (USN) and $LogFile (LSN).
07Interpretation pitfalls
- Deleted files' entries are marked free and are reused; the MFT does not shrink, so old entries may persist until reuse.
- The sequence number is incremented each time an entry is freed; references with a different sequence number point to an earlier file.
- Size values inside $FILE_NAME are not always accurate; take sizes from $DATA.
09Sources
- New Technologies File System (NTFS) libyal / libfsntfs (J. Metz) · checked 2026-10-14
- Master File Table (Local File Systems) Microsoft Learn · checked 2026-10-14
- MFTECmd README Eric Zimmerman (GitHub) · checked 2026-10-14