IT Forensics – Windows
Forensic Analysis of the Master File Table (MFT) – The Heart of the NTFS File System
Die Master File Table (MFT) ist eine der zentralen Strukturen des NTFS-Dateisystems. Für nahezu jede Datei und jedes Verzeichnis existiert ein eigener MFT-Eintrag, der zahlreiche Metadaten enthält. Im Rahmen einer professionellen Windows-Forensik liefert die MFT häufig wertvolle Hinweise auf die Existenz, Eigenschaften und Historie von Dateien.
Die MFT dient jedoch nicht als alleiniger Beweis. Erst die gemeinsame Auswertung mit weiteren Artefakten wie dem USN Journal, der Windows Registry, Event-Logs oder LNK-Dateien ermöglicht eine belastbare technische Rekonstruktion von Benutzeraktivitäten.
Why LanCologne?
Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and assist companies, solicitors, private individuals and, on a regular basis, the courts in the technical investigation of complex digital matters.
The examination is, as a matter of principle, carried out exclusively on a forensic copy or a forensic image. The original evidence remains unchanged and is stored in a manner that preserves its evidential integrity.
Our services
We analyse MFT entries, file attributes, timestamps, file names, directory mappings and other NTFS metadata. The aim is to objectively reconstruct technical processes and to provide transparent documentation of all findings as part of an IT forensic report.
Typical areas of application
So läuft eine MFT-forensische Untersuchung ab
Once a forensic image has been created, the MFT entries are extracted and analysed. This is followed by correlation with other artefacts in order to present technical relationships in a clear and comprehensible manner. All stages of the investigation are fully documented.
Warum ist die MFT so wichtig?
The MFT contains extensive information about files and directories and is therefore an essential part of almost every Windows forensic investigation. It often allows conclusions to be drawn about file operations, but it is never a substitute for a comprehensive analysis of all relevant artefacts.
Frequently Asked Questions
🔗 Related topics
LanCologne – Windows Forensics in Cologne
Do you need a professional analysis of the Master File Table or a Windows system? LanCologne can assist you with the forensically sound preservation of digital evidence and the objective analysis of relevant NTFS artefacts.