> For the complete documentation index, see [llms.txt](https://wongkenny240.gitbook.io/computerforensics/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wongkenny240.gitbook.io/computerforensics/incident-response-artifacts/master-file-table-mft.md).

# Master File Table (MFT)

## Overview

* Each Each NTFS volume will contain its own MFT (named $MFT stored within the volume root)
* NTFS metadata files such as the $MFT are not accessible via Windows Explorer or other standard application programming interface (API) file-access methods. 
* Each entries is 1,024 byte
* The first 16 MFT entries are reserved for essential NTFS artifacts

## Important elements of an entry

* Record type - Specifies whether a given entry represents a file or directory.
* Record # - An integer used to identify a given MFT entry. Record numbers grow sequentially as new entries are added.
* Parent record # - The record number of the parent directory. Each MFT entry only tracks the record number of its immediate parent, rather than its full path on disk. 
* Active/Inactive flag - MFT entries for deleted files or directories are marked “Inactive.” NTFS will automatically reclaim and replace inactive entries with new active entries to keep the MFT from growing indefinitely.
* Attributes - Each MFT entry contains a number of “attributes” that contain metadata about a file—everything from timestamps to the physical location of the file’s contents on disk.

  Important Attributes included the following:

  * $STANDARD\_INFORMATION
  * $FILENAME
  * $DATA.

![](https://3899724814-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LbSIGOSblVtuEjzcmhL%2F-MFOxfE2dggRXkl2MgoC%2F-MFOy0NTNT0JD06Fvbgi%2Fimage.png?alt=media\&token=aa7a0afa-c767-489c-ae5e-a1d7e349d6eb)

## MFT

* Collect the MFT and analyze the file timestamps

![](https://3899724814-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LbSIGOSblVtuEjzcmhL%2F-Mey1TYL5ZnAJYbno1-Y%2F-Mey1Z79RvEC69lnM3KN%2Fimage.png?alt=media\&token=ccd14bd5-4972-41cd-90a8-d6152ba70869)

* Use MFT2CSV to convert MFT file into .csv file
* Choose the MFT file to be converted
* Select the appropriate time zone
* Set the output path
* Click start processing to proceed the conversion process

![](https://3899724814-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LbSIGOSblVtuEjzcmhL%2F-Mey1TYL5ZnAJYbno1-Y%2F-Mey1dfrYyxhr6dEd7_V%2Fimage.png?alt=media\&token=4c365970-f247-44d6-abd5-b3b3691f1843)

* Open the converted file using text editor or Excel

![](https://3899724814-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LbSIGOSblVtuEjzcmhL%2F-Mey1TYL5ZnAJYbno1-Y%2F-Mey1kzmFI7rRcUp0_mR%2Fimage.png?alt=media\&token=2a6a483d-863e-4843-8657-8a45ac29ccad)

{% embed url="<https://github.com/jschicht/Mft2Csv/wiki/Mft2Csv>" %}

## $USNJRNL

* Choose the $J file of $USNJRNL file to be converted
* Select the appropriate time zone
* Select process output options
* Click start processing to proceed the conversion process

![](https://3899724814-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LbSIGOSblVtuEjzcmhL%2F-Mey1p7rlgF52Kykkil4%2F-Mey1uJHrmQ3O0EJvXGd%2Fimage.png?alt=media\&token=1b5737d0-716c-4ba8-91db-8d365ad072ec)

* Open Excel and then select Get Data through import

![](https://3899724814-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LbSIGOSblVtuEjzcmhL%2F-Mey1p7rlgF52Kykkil4%2F-Mey1yU88XG1vlD09LZs%2Fimage.png?alt=media\&token=36702e63-1872-4d9c-a5d2-5bcb5e0f1d89)

![](https://3899724814-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LbSIGOSblVtuEjzcmhL%2F-Mey2CrxdSt6pv0ZyU5u%2F-Mey2G0V2_ItKtoj9p6q%2Fimage.png?alt=media\&token=28d665d6-d0d5-4d6b-9daf-01828664eb1d)

## $LogFiles

* Choose the $LogFile and the previous processed MFT.csv file
* Select the appropriate time zone
* Click start processing to proceed the conversion process

![](https://3899724814-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LbSIGOSblVtuEjzcmhL%2F-Mey2J61ujbV0Ecz77MD%2F-Mey2OgAGXC6yOXG5n0W%2Fimage.png?alt=media\&token=c0b37338-3c0b-430e-953d-7137374a1572)