Join Us!

Notifications
Clear all

$MFT Tree  

  RSS
jhooker
(@jhooker)
New Member

Given that the MFT contains all the information about files/directories - would it be possible to take an image of the MFT and determine a file structure of a whole drive? -(Windows NTFS bla bla bla of course!)

Quote
Posted : 25/01/2008 5:20 pm
iruiper
(@iruiper)
Active Member

Well… In fact, the MFT will have something to do with a particular File System instead of the whole hard drive; so if you analyze a specific MFT you will be parsing a specific File System.

A great book on these concepts you should read is "File System Forensic Analysis" [Wesley 05 by Brian Carrier].

Regards.

ReplyQuote
Posted : 28/01/2008 2:25 pm
Share: