To view the MFT in EnCase in the most efficient manner, you should view it in a 1024 text style. The steps below show how to do this. The attached PDF includes screen shots.
- Create a new text style in the “Text Style” panel.
- Once in the Text Style “Attributes” section, do the following
- Enter the Name of the style. The name is only for reference, and does not affect the view itself.
- Set the Line Wrap to Max Size
- Set the Wrap length to 1024
- Then select the “Code Page”
- In the code page select Western European ISO. Then press OK.
- Then view the $MFT in text, and all the MFT headers should line up correctly