Mft2Csv¶

What Mft2Csv does¶

NTFS metadata to structured CSV

Mft2Csv, by Joakim Schicht, parses and decodes records from the NTFS Master File Table ($MFT) and writes extensive metadata to CSV for filtering, comparison, and correlation.

It accepts several source types, including extracted $MFT files, raw disk or partition images, mounted NTFS volumes, physical drives, shadow copies, partial or carved MFT data, and individual records. For a beginner forensic workflow, start with a verified working copy of an extracted $MFT.

Windows GUI and CLIStructured CSVMultiple source modesFocused or bulk review

Where it fits in DFIR¶

1PreserveOriginal source›2VerifyWorking `$MFT`›3ConfigureTime and output›4ExportCSV and log›5CorrelateJournal and case data

Use Mft2Csv when

You need a broad, filterable export of MFT record metadata, want to preserve detailed attribute fields, or need CSV for spreadsheet, database, timeline, or scripted review.

Use another view when

You need interactive tree navigation, byte-level validation, a repeatable modern command-line pipeline, or direct interpretation of $UsnJrnl:$J and $LogFile. Tool choice should follow the question.

Choose your journey¶

01Install and prepareVerify the release, create the case layout, and select a defensible working source.Complete when tool and evidence provenance are recorded.Beginner · 15–25 min 02Configure and exportChoose the source mode, time basis, format, precision, encoding, and output location.Complete when the CSV and parser log are reproducible.Guided · 25–35 min 03Review and interpretDecode field families, filter a lead, validate paths, and qualify conclusions.Complete when observation and interpretation are separated.Analyst workflow · 25–35 min 04Go hands-onPractise the interface in a safe simulation, then process authorised evidence.Complete when another analyst can reproduce the finding.Interactive · Two lab routes

What the CSV can and cannot establish¶

Strong observations

Record and sequence context
Allocation and structural state
SI and FN attribute values
Data attributes, resident state, and ADS indicators
Parser integrity results and record offsets

Requires corroboration

A complete rename or deletion sequence
The actor, process, or intent behind a change
Execution or user interaction
Correct historical paths for reused deleted parents
Complete recovery of file content

CSV is derived evidence

Preserve the original binary artefact, exact Mft2Csv version, settings, log, and output hashes. A convenient CSV does not replace the source or remove parser limitations.

Further reference: Mft2Csv project, author's usage guide, and Mft2Csv wiki.