$MFT (Master File Table)
Also called master file table, MFT records, NTFS metadata, MACB timestamps.
- PLATFORM
- Windows
- CATEGORY
- Filesystem Metadata and Timestamps
- INDEX
- 25 of 36
- PROVES
- 5 findings
- CANNOT PROVE
- 5 limits
- QUESTIONS
- 4 answered
The NTFS index of every file and directory on a volume, holding two independent sets of four timestamps per file plus, for small files, the file's entire content.
Where it lives
\$MFT in the root of every NTFS volume
Name the location in the preservation request rather than describing the artifact in general terms. A request that asks for the record by its path is one the responding party can act on and one a court can enforce; a request for “all forensic evidence of $mft (master file table)” is neither.
What it records
Each file and directory has a record in the master file table carrying its name, parent reference, size and attributes. Two attributes each hold four timestamps: the standard information attribute, whose values are what tools and Explorer display, and the filename attribute, updated by the operating system on operations such as rename and move. Small files are stored resident inside the record itself. Records for deleted files remain in the table, marked unallocated, until reused by a new file.
What it proves — and what it cannot
These two panels carry equal weight, deliberately. The right-hand column is not a disclaimer: it is the specific, mechanical reason an inference fails, and it is the column opposing counsel will read back to a witness on cross-examination.
What it proves
FINDINGS THIS ARTIFACT WILL SUPPORT ON ITS OWN TERMS.
- That a file existed with a given name, in a given directory, at a given size — including files deleted long ago whose records have not yet been reused
- Creation, modification, metadata-change and last-access times for each file, from both attribute sets
- Signs of timestamp manipulation, where the standard information values are inconsistent with the filename attribute values or with record sequence
- The complete content of small resident files, recoverable from the record with no carving
- Directory structure and parent relationships, which reconstruct where a file lived
What it cannot prove
INFERENCES IT WILL NOT CARRY, HOWEVER STRONGLY IT POINTS.
- Who created or modified a file. NTFS metadata carries no user attribution at all — object ownership is a security descriptor question and it identifies the owning account, not the actor
- That a displayed timestamp is genuine. Standard information values are settable through ordinary interfaces, which is what timestamp manipulation tools do; the filename attribute is harder to set but not a guarantee
- That last-access time reflects access. Last-access updating has been disabled by default on many Windows versions and its default has changed between releases, so the volume's actual setting has to be established rather than assumed
- The order of events beyond what the timestamps say. The table is an index, not a journal, and it holds current values rather than a history of changes
- That a file was copied to another device. Copying writes new records on the destination volume, which is usually the volume nobody has
How the finding is attacked
An opinion built on this artifact meets these arguments. Each of them is answerable, and each of them is answered before the report is served rather than at a deposition.
- Establishing whether last-access updating was enabled on the volume, which frequently removes the artifact the opinion relied on
- Arguing timestamp values were altered, and asking whether the examiner compared the two attribute sets rather than reporting one
- Pointing out that a copy operation resets timestamps in ways that mimic or mask the pattern being described
- Questioning the time zone and clock assumptions applied to the values, since NTFS stores them in UTC and every displayed local time is a conversion
What survives, and for how long
Records for deleted files persist in the table until reused, which on a quiet volume can be a very long time and on a busy one is quick. The table survives a quick format, which rebuilds structures without overwriting most of the volume, but not a full overwrite.
More matters are decided by what an artifact never kept than by what it says, which makes preservation timing the most consequential decision in the matter — and it is usually made months before anyone examines anything. The evidence preservation deadline calculator works from the date you first anticipated litigation.
Questions counsel ask
What is the difference between $MFT and $LogFile?
The master file table is an index of current state: one record per file, holding its name, size, location and timestamps as they stand now. $LogFile is a transaction journal recording the individual metadata operations NTFS performed, in order, so that an interrupted operation can be rolled back. The table tells you what a file is; the journal tells you what was done to it, for the short period the journal still covers.
Can $MFT timestamps be faked?
The ones normally displayed can. The standard information attribute's four timestamps are settable through ordinary interfaces, which is exactly what timestamp manipulation tools do. The filename attribute holds a second set that the operating system updates on operations such as rename and move and that is harder to set directly. Comparing the two sets is the standard test, and an examiner who reports only one has skipped it.
Does the $MFT show who created a file?
No. NTFS metadata contains no record of the user who performed any operation. A file has an owner in its security descriptor, but that identifies the account that holds ownership rather than the person who created or modified the content. Attribution of a filesystem event to a user requires a different artifact — event logs, per-user shell records, or application logs.
Can you recover deleted files from the $MFT?
You can recover their metadata reliably and, for small files, their entire content. Records for deleted files remain in the table marked unallocated until a new file reuses them, so names, sizes, parent directories and timestamps often survive long after the data is gone. Small files are stored resident inside the record itself and come back complete with no carving at all.
Terms used on this page
Every term below is defined in the forensic glossary — what it is, why a case turns on it, and what happens when it is mishandled.
Related artifacts
No artifact carries a matter on its own. These are the records that corroborate, contradict, or supply the timeline this one cannot.
$LogFile (NTFS Transaction Journal)
The NTFS transaction journal, recording individual metadata operations in order so they can be rolled back — the most granular record of filesystem activity, covering the shortest window.
$UsnJrnl (USN Change Journal)
A per-volume journal recording every change to every file — creation, deletion, rename, data overwrite — with a timestamp, a filename and a reason code for each entry.
Recycle Bin ($I and $R Files)
Deleted files moved to the Recycle Bin are stored as a renamed copy of the content plus a metadata file recording the original path, original size and the deletion time.
Volume Shadow Copies
Point-in-time block-level snapshots of a volume, often holding an earlier version of a file that has since been altered or deleted — sometimes the only copy of a document as it originally stood.
Whether the $mft (master file table)evidence in your matter supports the opinion built on it is a question with a testable answer. Law & Forensics retains court-tested digital forensic expert witnesses and forensic neutrals.
A conflicts check and scoping call follow, normally within one business day. Please do not send privileged or case-sensitive material until conflicts have cleared.
- Can This Artifact Prove That?
Start from the claim rather than the artifact: which records bear on it, and what no combination of them establishes.
- Computer forensics
The examination this artifact is collected and analysed in, scoped to a matter and reported so it can be tested.
- The artifact index
All 36 entries, grouped by what they bear on and filterable by platform.
- Daubert and digital evidence
Why an opinion stated one level too strongly is an admissibility problem rather than a point for cross-examination.
Attorney advertising / expert services. This page describes forensic artifacts and the procedural rules that govern expert evidence in general terms. Artifact behaviour varies by operating-system version, build, and configuration, and every observation has to be verified against the system actually in front of you. Nothing here is legal advice, and it is not a substitute for checking the rules, standing orders, and case law of your own forum.