Where Is the NTFS Master File Table?
NTFS $MFT location, zone behavior and forensic access notes.
Last updated
NTFS tracks every file through the Master File Table metafile at the volume root, normally reserved in a half-hidden zone early on disk. Forensics timelines parse it for deleted-file ghosts long after Explorer forgets.
Never edit $MFT live; image the volume and parse offline. Resident tiny files live inside MFT records while big ones scatter across extents.
Where Windows stores this, by platform
C:\$MFT
Metafile path visible to forensic tools, not Explorer. Parse with MFTECmd or analyzers from an image, never on a live suspect disk. $MFTMirr and $LogFile beside it aid recovery. Raw access needs admin plus volume locks.
Frequently asked questions
Can I open $MFT in Explorer?
No, the path above needs forensic tools and admin rights. Image first, then parse the copy.
Why do deleted files appear in MFT tools?
Records linger flagged unallocated until reused. Timelines above recover names and timestamps, not always content.
Notice an outdated path? Let us know.