MFT - Master File Table

In the NTFS file system, the Master File Table (MFT) , is database containing metadata about every file and directory on the volume. This includes details such as file name, size, creation time, modification time, and even information about deleted files, An MFT record is typically 1024 bytes in size

Let’s take an overview what is the MFT record contain in close

We Just cover only this attrbutes

Each record in the MFT is 1024 bytes in size and contains several key attributes:

1. Signature — FILE (0x00 - 0x03)
   – 0x46494C45: Identifies the record as an MFT entry with the signature “FILE”.
2. STANDARD_INFORMATION (Attr 0x10) (SI) : contains standard file attributes, and the MACB (Modified, Accessed, Changed , Birth) timestamps shown by Windows Explorer.
3. File Name (FN) – 0x30: Includes the file or directory name and its parent directory.
4. Data – 0x80: Points to the actual file data on disk
   • Resident Files: For small files (roughly under 700 bytes), the actual file content is stored directly here inside the MFT record itself.
   • Non-Resident Files: For larger files, this attribute holds pointers (data runs) directing to the external disk clusters where the data resides.
5. End Marker (0xFFFFFFFF)
   

Let’s go deeper to more Understand

$MFT file (the whole table)
 └─ Record (1024 bytes each)
     └─ Record Header (fixed layout, first ~56 bytes)
         └─ Fixup Array (sector corruption check)
     └─ Attribute 1 ($STANDARD_INFORMATION)
                 └─ Attribute Header (16 bytes, same for every attribute)
                 └─ Resident or Non-Resident?
                     └─ Content (timestamps, filename, file data, or data runs)
     └─ Attribute 2 ($FILE_NAME)
                 └─ same pattern...
     └─ Attribute 3 ($DATA)
                 └─ same pattern, possibly non-resident...
     └─ End marker (0xFFFFFFFF) → no more attributes

• The First Attribute Offset (at MFT header offset 0x14, usually 0x38 / 56) points to the first attribute in the MFT record.
• All attribute offsets are relative to the start of the MFT record (offset 0x00), not relative to the previous attribute.
• Every attribute header contains a Length field (total size of that attribute).
• To find the next attribute:

Common Attribute Header (first 16 bytes — present on every attribute, resident or not)

First Attribute Offset is at 0x38. Since our record starts at absolute address 0B78F800, our first attribute starts

Content is stored directly inside this MFT record.

Content lives elsewhere on disk.

This is always resident . Once you've computed content_start = attribute_start + Content_Offset here's what's inside, relative to that content start:

A file may contain multiple $FILE_NAME attributes (long name, short DOS name)

First $FILE_NAME Block (Short/DOS Filename Layout)

Second $FILE_NAME Block (Long Filename Layout) , same the short file name U can see that in the image.

Attribute 3 & $DATA (Offset 0xB78F990)