IT Forensics – Windows
Forensic Analysis of the Master File Table (MFT) – The Heart of the NTFS File System
The Master File Table (MFT) is one of the key structures of the NTFS file system. There is a separate MFT entry for almost every file and directory, containing a wealth of metadata. In the context of professional Windows forensics, the MFT often provides valuable insights into the existence, properties and history of files.
However, the MFT does not serve as the sole evidence. Only by analysing it in conjunction with other artefacts – such as the USN journal, the Windows Registry, event logs or LNK files – is it possible to carry out a reliable technical reconstruction of user activities.
Why LanCologne?
Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and assist companies, solicitors, private individuals and, on a regular basis, the courts in the technical investigation of complex digital matters.
The examination is, as a matter of principle, carried out exclusively on a forensic copy or a forensic image. The original evidence remains unchanged and is stored in a manner that preserves its evidential integrity.
Our services
We analyse MFT entries, file attributes, timestamps, file names, directory mappings and other NTFS metadata. The aim is to objectively reconstruct technical processes and to provide transparent documentation of all findings as part of an IT forensic report.
Typical areas of application
This is how an MFT forensic investigation is carried out
Once a forensic image has been created, the MFT entries are extracted and analysed. This is followed by correlation with other artefacts in order to present technical relationships in a clear and comprehensible manner. All stages of the investigation are fully documented.
Why is MFT so important?
The MFT contains extensive information about files and directories and is therefore an essential part of almost every Windows forensic investigation. It often allows conclusions to be drawn about file operations, but it is never a substitute for a comprehensive analysis of all relevant artefacts.
Frequently Asked Questions
🔗 Related topics
LanCologne – Windows Forensics in Cologne
Do you need a professional analysis of the Master File Table or a Windows system? LanCologne can assist you with the forensically sound preservation of digital evidence and the objective analysis of relevant NTFS artefacts.