Notifications
Clear all

$MFT Tree

2 Posts
2 Users
0 Likes
260 Views
(@jhooker)
Posts: 17
Active Member
Topic starter
 

Given that the MFT contains all the information about files/directories - would it be possible to take an image of the MFT and determine a file structure of a whole drive? -(Windows NTFS bla bla bla of course!)

 
Posted : 25/01/2008 5:20 pm
iruiper
(@iruiper)
Posts: 145
Estimable Member
 

Well… In fact, the MFT will have something to do with a particular File System instead of the whole hard drive; so if you analyze a specific MFT you will be parsing a specific File System.

A great book on these concepts you should read is "File System Forensic Analysis" [Wesley 05 by Brian Carrier].

Regards.

 
Posted : 28/01/2008 2:25 pm
Share: