Where Is the NTFS Master File Table Stored?
Where the NTFS Master File Table lives, why Explorer cannot see it, and which tools collect it for analysis.
Last updated
The Master File Table is the index of every file and folder on an NTFS volume, itself stored as a hidden system file at the volume root. Each entry packs timestamps, permissions, sizes, and data runs into fixed-size records. Even the MFT describes itself in entry zero.
Explorer never shows it and normal copies fail because Windows locks it open. Forensic collection uses dedicated imagers, then parsers convert the table to CSV. Deleted files linger as reusable records, which is exactly what makes the MFT the first stop in an investigation.
Where Windows stores this, by platform
C:\$MFT
Hidden protected system file at each NTFS volume root holding one record per file, including deleted ones. Invisible to Explorer and locked against plain copies. Collect with KAPE or forensic imagers, then parse with MFTECmd. The $MFTMirr mirror backs up the first entries.
Frequently asked questions
how do I extract the $MFT
Collect it with KAPE, FTK Imager, or RawCopy, which read locked system files. A plain copy fails because the OS holds $MFT open. Admin rights are required, and the file belongs to its volume root path.
how do I analyze the $MFT
Run MFTECmd or Mft2Csv against the collected file for CSV timelines of every entry. Deleted records parse until NTFS reuses them, revealing past tools and documents. Correlate with USN Journal output for change history between MFT states.
what if the $MFT is corrupted
The $MFTMirr backup holds the first entries including the MFT record itself. The boot sector points at both locations. Recovery tools consult the mirror when the primary first record corrupts.
Notice an outdated path? Let us know.