$MFT Change?


  1. Posts : 1
    Windows 7 32 bit
       #1

    $MFT Change?


    I have been studying Forensics and have encountered a problem with the $MFT file in Windows 7. I created a small text file and saved it to the root, which should appear as a resident file on the MFT, as it is under 1024 bytes. However, after copying the $MFT file and examining it in Win Hex, the newly created text file does not appear in the MFT, but is accessable and clearly in the c:/.
    After more investigation, it appeared that the $MFT file had not been modified since the clean install of Windows 7, though I have created numerous folders and files since install. All of which should appear in the $MFT either as a resident or non-resident file. I performed this same routine on an XP machine and was able to find the file in $MFT.
    How is 7 handling the file table differently than XP, as both use NTFS file system? Where is it located in Windows 7. Thanks in advance.
      My Computer


  2. Posts : 9
    Windows 7 Professional x64
       #2

    I saw your question but can't spew NTFS details off the top of my head. I'm curious though... did you ever go back over reference material and solve your problem? Manually investigating the MFT & $MFT sounds worthwhile from a learning POV, but have you also found some freeware tools that will dump/display such data in a useful form? So that you can sanity check what you come up with manually?
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 07:39.
Find Us