Master File Table

What the Master File Table Does in NTFS

The Master File Table, or MFT, is the core metadata structure NTFS uses to represent every file and directory on a volume. Each record links the logical name of an item to its attributes, timestamps, security descriptor, and data runs, which is why a healthy MFT is fundamental to both normal file access and later recovery work.

Because the MFT is metadata rather than file content, it often preserves evidence even when the original file is deleted, renamed, or partially overwritten. That makes it one of the first places investigators look when they need to reconstruct activity on a Windows system.

Why MFT Records Matter for File System Analysis

An MFT record is more than a directory listing. It is the authoritative index NTFS consults to locate content, interpret file attributes, and tie together names, paths, and timestamps. In practice, that means the MFT can reveal how a file changed over time, whether multiple names pointed to the same record, and whether the record still exists after the file’s data has been removed.

Forensic value comes from the record structure itself. Attribute combinations, record sequence numbers, and timestamp patterns can help distinguish ordinary activity from artefacts of deletion, reuse, or tampering. The MFT is therefore not just an implementation detail, it is a timeline source.

NHIMG’s File System Forensics Guide covers NTFS MFT attributes and USN journal analysis in the broader context of file system reconstruction.

How Investigators Use MFT Evidence

Investigators use MFT records to answer practical questions: when a file appeared, whether its name changed, whether timestamps look inconsistent, and whether the file still has recoverable metadata after deletion. When combined with other NTFS artefacts, the MFT can help build a more reliable sequence of user and system activity than timestamps alone.

MFT analysis is especially useful when the live system is unavailable or when file content has been removed but the metadata remains. It also helps validate whether a file path, timestamp set, or directory entry is genuine, or whether it may have been manipulated in an attempt to obscure activity.

Windows Forensic Artefacts Guide places MFT analysis alongside other Windows artefacts such as the registry, event logs, shell items, and execution evidence.

Integrity, Corruption, and Recovery Implications

If the MFT is damaged, NTFS can lose the ability to interpret file references correctly. That can affect normal access, directory enumeration, deletion handling, and recovery from partial corruption. A corrupted or inconsistent MFT can also complicate forensic interpretation because missing links between records and data runs reduce confidence in the reconstructed state of the volume.

Recovery work often depends on whether the record is intact enough to interpret. Even where file data is gone, a usable record may still preserve names, timestamps, and location pointers that support recovery attempts or post-incident review. The practical point is that MFT integrity affects both system usability and evidentiary value.

How the MFT Fits into Windows Incident Response

In incident response, the MFT is valuable because it can confirm file activity that other sources only hint at. It can help identify deleted tooling, renamed payloads, or filesystem changes that align with suspicious execution paths. Analysts often use it together with journal-based artefacts and other host evidence to validate what happened on the volume.

That same value creates an operational dependency: if the MFT is overwritten, truncated, or inconsistently updated, both defenders and investigators lose a major source of truth. For that reason, MFT artefacts are usually treated as high-value evidence during triage and preservation.

Related resources from NHI Mgmt Group

• Osquery File Table
• Death Master File
• Why do file integrity tools miss attacks like Copy Fail?
• How should organisations reduce internal file exposure in Teams and SharePoint?