filesystemsntfscomputer-forensicsntfs-mft

Where is MFT at NTFS filesystem


I wonder if everywhere I find the FF FF FF FF it indicates an MFT block there. Because here they say:

you can quite clearly see the 0xFFFFFFFF end of file marker that marks the end of the new MFT entry (byte offset 504).


Solution

  • Not exactly. All MFT entries are aligned to a cluster or file record size which are multiples of the sector size of the disk. Usually file records in the MFT are 1024 bytes long, the size of a file record and the offset to the MFT are stored in the first sector of the volume in a structure called NTFS bios parameter block. You can find the structure in the ReactOS source code here.

    All MFT file entries have at offset 0 a magic number (e.g. FILE or BAAD). The exact size of the MFT can be obtained by parsing the attributes of the first file record of the MFT which is the MFT itself. An unnamed non-resident data attribute contains the size of the entire MFT and a data run of it's fragments on the disk.

    The 0xFFFFFFFF that article talks about is found in the type field of last attribute that denotes the end of the file record's attributes. It would be a waste of time and not entirely accurate to parse for this value since other files might contain it.