Notifications
Clear all
Topic starter
Given that the MFT contains all the information about files/directories - would it be possible to take an image of the MFT and determine a file structure of a whole drive? -(Windows NTFS bla bla bla of course!)
Posted : 25/01/2008 5:20 pm
Well… In fact, the MFT will have something to do with a particular File System instead of the whole hard drive; so if you analyze a specific MFT you will be parsing a specific File System.
A great book on these concepts you should read is "File System Forensic Analysis" [Wesley 05 by Brian Carrier].
Regards.
Posted : 28/01/2008 2:25 pm