What is MFT and why is it significant in Windows forensic investigations?

• A. Memory dump content
• B. The Master File Table stores metadata about files on NTFS; it helps reconstruct file activity and recover deleted files
• C. Network session records
• D. User account credentials

Answer: (B)

The Master File Table on NTFS is the central index that holds a record for every file and directory. Each MFT entry stores metadata such as creation, modification, and last access times; file size; the file name; security information; and pointers to where the actual data blocks live. Because this metadata forms a complete map of the filesystem’s objects, it lets you reconstruct what existed, when it existed, and how it was used, even if the file content itself has been altered or moved.

In practice, examining the MFT enables you to build accurate timelines of file activity, identify file renames or moves, and trace directory traversal. For deleted files, the MFT often preserves the metadata and references long enough for investigators to recover filenames and sometimes data, provided the underlying data blocks haven’t been overwritten. NTFS also stores a backup/MFT mirror, which can aid recovery in cases of corruption. This makes the MFT a foundational artifact for Windows forensic investigations because it reveals both the existence and the whereabouts of files, independent of user actions and other system logs.