MFTExplorer¶

What MFTExplorer does¶

Graphical NTFS record examination

MFTExplorer is Eric Zimmerman's graphical viewer for the NTFS Master File Table ($MFT). It reconstructs a directory tree and presents file records, parent relationships, attributes, allocation state, data streams, raw bytes, and NTFS timestamps in an interface suited to focused review.

Use it to answer a defined file-system question interactively. Use a command-line parser such as MFTECmd when you need repeatable bulk export, automation, or timeline processing across many sources.

Windows GUIPreserved `$MFT`Focused record reviewRead-only workflow

Version and screenshot context

The supplied screenshot records MFTExplorer v2.1.0. The official EZ Tools catalogue identifies MFTExplorer as the graphical $MFT viewer and may list a newer release. Record the exact version used in your case because parsing behaviour and interface labels can change.

Where it fits in a DFIR workflow¶

1PreserveVerified `$MFT` copy›2OpenIdentify source and version›3LocateName, path, or record›4InspectAttributes and timestamps›5CorroborateJournal and case evidence

Questions it answers well

Which record represents the item? What name and parent references are stored? Is the record currently allocated? Which attributes and timestamps are present? Does NTFS indicate alternate data, a directory, or a possible timestamp anomaly?

Questions it cannot answer alone

Who caused a change, why it occurred, whether a file executed, whether deleted content is recoverable, or whether a suspicious-looking timestamp proves manipulation. Those conclusions require corroborating evidence.

Choose your journey¶

01Prepare and openDefine the question, verify a working copy, and learn the workspace.Complete when the examination basis is reproducible.Beginner · 15–25 min 02Examine recordsSearch, compare candidates, inspect identities, and qualify timestamps.Complete when a selected record supports a bounded observation.Guided · 20–30 min 03Correlate and reportTest the observation against companion evidence and write a defensible finding.Complete when every claim is traceable to a source.Analyst workflow · 20–30 min 04Go hands-onPractise in a safe simulation, then complete an authorised evidence lab.Complete when another analyst can review your finding.Interactive · Two learning routes

The evidence model¶

Identity

Entry / sequence: The reusable record slot and its generation.
Parent entry / sequence: The stored relationship used to reconstruct a path.
Name and namespace: The filename attribute represented by the record.

State

In use: Whether NTFS currently marks the record allocated.
Directory / ADS: Whether it represents a directory or has named data attributes.
Size and flags: Recorded size and flags, not recovered content.

Time

`$STANDARD_INFORMATION`: Four timestamps commonly changed by Windows and applications.
`$FILE_NAME`: Four timestamps updated under different rules.
Possible timestomp: A parser lead to investigate, not proof of manipulation.

Bounded example: MFT record 28432-3 in a verified working copy represents C:\Users\Avery\Downloads\invoice-review.txt and is marked not in use. This supports retained file metadata and an unused allocation state. It does not alone identify the deletion mechanism, actor, intent, execution, or whether content remains recoverable.

Further reference: official EZ Tools catalogue and MFT parser source.