File System: MFT Entries (Basic)

The MFT, as previously stated is the primary file in the NTFS file system. This file points to the locations of the other files on the computer.

Within the MFT are “entires”, each entry contains information about the file it points to. These entries provide a variety of information about file it points to – including:

File Name, File Size, dates about the file included – Created, Modified, Written and Accessed, location of the data of the file.  Typically an MFT entry is 1024 bytes in size, or two sectors, and starts with “File0” or “File*”, with the information following that.

The first 16 MFT entries within the MFT are reserved, and as they point to key NTFS artefacts these include $BitMap and $Log. The first two entries of the MFT are $MFT – which desribes the MFT. This may seem odd, but it needs to be done. Everything with the NTFS is a “file”, so the MFT, which contains all the information about files, e.g word docuemtns and emails, is also a file. Therefore MFT has an entry within itself that desribes is size, location, etc. The second entry with in the MFT is the $Mirror. The MFT Mirror is a back up of the first 16 MFT entries, that are stored just in case there is a problem with the primary MFT entries.

A more detailed article on the MFT entries will follow.

A good resource on the MFT, and NTFS in general is book –   File System Forensic Analysis

Advertisements

2 Responses to “File System: MFT Entries (Basic)”

  1. File System: MFT (technical) « Data – Where is it? Says:

    […] File System: MFT (technical) Posted on August 11, 2008 by 585 MFT – The Master File Table, this is the first and key file, in an NTFS file system. For a very basic understanding of the MFT please read this post […]

  2. Forensics: What is the $MFT? « Data – Where is it? Says:

    […] of this information is stored in an entry within the MFT, called (somewhat unsurprisingly)  “MFT Entries“. The MFT Entries are 1024 bytes, as standard. Every file and folder, has to have an MFT […]


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: