Master File Table (MFT)

A database that stores metadata about every file and directory on a NTFS Volume.

Each file and directory is represented as en entry in the table and are assigned a unique identifier, called the MFT record number.

The MFT is itself a file, and therefore also stores its own metadata.

Usefulness for Forensics

• Stores details about each file, including timestamps, permissions, and data content locations.
• It also stores timestamps and types of file modifications, which can help construct a timeline.
• If the MFT entries of deleted file have not been reused, then they will still be present, allowing details on deleted files to be recovered.

Useful MFT Fields

$STANDARD_INFORMATION

• Creation Time: The date and time when the file or directory was created.
• Modification Time: The date and time when the file or directory was last modified.
• Access Time: The date and time when the file or directory was last accessed.
• Entry Modified Time: The date and time when the MFT entry itself was last modified.
• Use Case: These timestamps are vital for timeline analysis to determine the sequence of user actions and file usage.

$FILE_NAME

• File Name: The name of the file or directory.
• Parent Directory: The MFT record number of the directory in which the file resides.
• Additional Timestamps: Similar to $STANDARD_INFORMATION, but specific to this attribute and sometimes used as a fallback.
• Use Case: This attribute is used to confirm the integrity of file paths and names in the system, which is crucial for tracking user movements and detecting unauthorised changes.

$DATA

• Actual Data or Pointer: Either the data itself for smaller files or a pointer to the data for larger files.
• Use Case: Direct analysis of file contents and data recovery, especially important in cases involving data theft or unauthorised data manipulation.

$LOGGED_UTILITY_STREAM

• Transactional Data: Holds data related to transactional NTFS (TxF), which logs temporary file state changes.
• Use Case: Can be used to track changes made during a transaction, useful in cases of system crashes or unexpected shutdowns to determine interim states.

$BITMAP

• Cluster Allocation: Maps which clusters are in use by the file.
• Use Case: Useful for recovering deleted files or reconstructing file data from clusters not overwritten by new data.

$SECURITY_DESCRIPTOR

• Owner ID: Identifies who owns the file.
• Permissions: Details what permissions are attached to the file (who can read, write, execute, etc.).
• Audit Settings: Specifies what operations (such as access or changes) are logged by the system.
• Use Case: Critical for determining access rights and detecting potential security breaches where permissions may have been altered.

$VOLUME_INFORMATION

• Volume Serial Number: Unique identifier for the volume.
• Flags: System flags related to the volume, such as whether it is dirty (improperly unmounted).
• Use Case: Useful in multi-disk systems to link files and activities to specific volumes, essential in systems recovery and forensic analysis across multiple drives.

$INDEX_ROOT and $INDEX_ALLOCATION

• Index Entries: Used in directories to index contained files for quick access.
• Use Case: Forensically important for reconstructing directory structures and understanding how data was organised and accessed, particularly in complex investigations involving numerous files and directories.