MFT
Master File Table
Master File Table (NTFS)
The Master File Table is the central directory of the NTFS file system: it keeps an entry for every file with name, size, timestamps and the storage location. Forensically it is a first-rate source because it documents in detail which files exist or existed and when they were altered. It is a centrepiece of Windows forensics.
History & facts. In the MFT, NTFS keeps extensive metadata for every file, including several timestamps (creation, modification, access, MFT entry change). Even after deletion, entries can persist for a time before being overwritten — valuable for reconstruction. The various timestamps are also a starting point for detecting manipulation (timestomping) when they do not match each other.
Outlook & recommendation. The MFT is one of the most productive sources for timeline analyses under Windows because it provides the „when“ of numerous file operations. For robust conclusions, its timestamps should be matched with further sources (logs, registry, prefetch) — contradictions expose manipulation. Combined with tools such as The Sleuth Kit and Plaso, the MFT becomes a central building block of the reconstruction of an incident.