Examine MFT Records¶

Locate relevant records¶

Choose the narrowest reliable starting point, then review all plausible matches.

Name or extension

Search for an exact or distinctive filename. Similar names can belong to different paths, namespaces, or record generations.

Directory path

Navigate the reconstructed tree when location matters. Confirm parent entry and sequence references rather than trusting the displayed path alone.

Entry and sequence

Use the record identity when another source provides it. The sequence number helps distinguish reuse of the same MFT entry.

Time window

Sort or filter a defined interval, but state which timestamp field is being used and preserve surrounding records for context.

Preserve the search state

Record the exact term, active filters, sort order, match count, selected row, displayed time basis, and screenshot or export path. Run a deliberately absent filename as a negative control when it will help demonstrate the filter behaved as expected.

Compare candidates before selecting one¶

Do not choose a row because its filename looks familiar. Compare:

full reconstructed path and filename namespace;
entry and sequence plus parent entry and sequence;
in-use state, directory state, size, flags, and ADS indication;
the case host, volume, and expected time window; and
duplicate or reused records that could describe a different object.

Beginner decision rule

The case-relevant record is the candidate whose identity and context fit the question. A matching name alone is not enough.

Read the selected record¶

Identity

Entry / sequence: The reusable record slot and its generation.
Parent entry / sequence: The stored parent relationship used to reconstruct a path.
Name and type: The filename attribute and namespace represented by the record.

State

In use: Whether NTFS currently marks the record allocated.
Directory / ADS: Whether it represents a directory or contains named data attributes.
Size and flags: Recorded metadata, not a guarantee that content is recoverable.

Time

`$STANDARD_INFORMATION`: Four timestamps commonly changed by Windows and applications.
`$FILE_NAME`: Four timestamps stored with a filename attribute and updated differently.
Possible timestomp: A parser heuristic to test, not a verdict.

Interpret timestamps carefully¶

Field	Plain-language meaning	Important limitation
Created	Time recorded for creation in that attribute set	Copying, extraction, restore, and application behaviour can create a new value
Modified	Time recorded for file-content modification	Metadata-only changes may not update it; some tools can set it
Record changed	Time the MFT record metadata changed	It does not state which field changed or identify an actor
Accessed	Time recorded for access	Windows policy, delayed updates, and application behaviour limit precision

Differences between $STANDARD_INFORMATION (0x10) and $FILE_NAME (0x30) timestamps can be useful, but they require context. Do not label a file "timestomped" from a flag or timestamp ordering alone.

Capture the observation¶

Record the selected row, entry and sequence, parent identity, full path, state, relevant attributes, exact timestamp labels and values, time-zone basis, source identity, MFTExplorer version, warnings, and search state. Keep observation separate from interpretation.