Review and Interpret Mft2Csv Output¶
Validate before filtering¶
Confirm the expected output exists and is non-empty. Preserve the log and any warnings, then record the CSV name, byte size, hash, row count, delimiter, encoding, time-zone setting, and Mft2Csv version.
Decode the field families¶
| Prefix or field | Meaning | Analyst use |
|---|---|---|
HEADER_* |
MFT record-header values | Review signature, allocation flags, sequence, LSN, and structural state |
SI_* |
$STANDARD_INFORMATION values |
Compare the SI timestamp set and attributes |
FN_* |
$FILE_NAME values |
Review filename, parent relationship, namespace, and FN timestamps |
DATA* |
$DATA attribute values |
Review size, resident state, names, and possible alternate streams |
RecordOffset |
Hex offset inside the $MFT file |
Return to the parsed record; it is not a physical-disk offset |
IntegrityCheck |
Fixup-based record integrity result | Treat failure as a validation issue requiring source and parser review |
USN / LSN |
Update Sequence / log sequence references | Correlation keys, not a complete history by themselves |
Timestamp abbreviations are tool-specific
In Mft2Csv output, CTime, ATime, MTime, and RTime are documented as file-created, file-modified, MFT-entry-modified, and last-access times respectively. Preserve the exact column name in notes instead of translating it from memory.
Investigate a defined lead¶
For case SUSA-M2C-117, triage identifies invoice-review.txt in C:\Users\Avery\Downloads around 2026-08-18 10:20Z.
- Filter the filename column for the exact name and common variations.
- Review all matches; compare record and sequence, parent reference, namespace, allocation state, size, and path.
- Preserve the exact filter, active sort, row count, selected row, and source-output identity.
- Compare SI and FN timestamp fields without treating disagreement as automatic timestomping.
- Check signature and integrity fields plus parser warnings.
- Correlate record identity and time context with
$UsnJrnl:$J,$LogFile,$I30, content, and relevant host artefacts.
Critical deleted-path limitation
Resolved paths for deleted files and folders may be wrong when a parent record has been reused. Validate the stored parent reference, sequence context, neighbouring records, and independent evidence before reporting a deleted path as fact.
Separate observation from interpretation¶
Observation
The retained CSV contains record 28432-3, an unused record named invoice-review.txt, with parent reference 28401-2 and recorded SI/FN timestamps.
Interpretation
The parsed $MFT supports retained metadata for a file record associated with the stated parent context. Independent USN evidence may support a rename/deletion sequence.
Do not overclaim
The CSV alone does not identify an actor, intent, execution, content recovery, or a complete chronology. A parser-derived path can also be uncertain for deleted records.