thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Master File Table (MFT)

The NTFS metadata file that holds a record for every file and directory on the volume.

Definition

Each $MFT record includes attributes such as $STANDARD_INFORMATION, $FILE_NAME and $DATA; small files may be stored resident within the record. Records of deleted files persist until reused, allowing recovery and timeline reconstruction. Tools like MFTECmd parse it.

Example

Parsing $MFT with MFTECmd to find files created in C:\Users\Public during the intrusion window.

Exam tip

Deleted file records remain in the MFT until overwritten.

Related terms