±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36459
New Yesterday: 3 Visitors: 152

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

$MFT Tree

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

jhooker
Member
 

$MFT Tree

Post Posted: Jan 25, 08 17:20

Given that the MFT contains all the information about files/directories - would it be possible to take an image of the MFT and determine a file structure of a whole drive? -(Windows NTFS bla bla bla of course!)  
 
  

iruiper
Senior Member
 

Re: $MFT Tree

Post Posted: Jan 28, 08 14:25

Well... In fact, the MFT will have something to do with a particular File System instead of the whole hard drive; so if you analyze a specific MFT you will be parsing a specific File System.

A great book on these concepts you should read is "File System Forensic Analysis" [Wesley 05 by Brian Carrier].

Regards.  
 

Page 1 of 1