MFT (Master File Table).

The core NTFS metadata structure that stores one 1024-byte record per file or directory on a volume, anchoring nearly all Windows file-system forensics. It belongs to the Forensics & IR category of cybersecurity.

The core NTFS metadata structure that stores one 1024-byte record per file or directory on a volume, anchoring nearly all Windows file-system forensics.

The Master File Table ($MFT) is the heart of the NTFS file system; every file, directory, and even the MFT itself is represented by a fixed-size record containing attributes such as $STANDARD_INFORMATION, $FILE_NAME, and $DATA. Forensic analysts parse the MFT to recover timestamps (the four MACB times in both $SI and $FN), file sizes, parent-child relationships, alternate data streams, and resident file content for very small files. Deleted entries often remain recoverable until reused, making the MFT essential for timeline analysis and anti-forensic detection. Tools such as MFTECmd, analyzeMFT, and Velociraptor extract and normalise records for triage.

Defences for MFT (Master File Table) typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: $MFT, Master File Table.