$MFT Change?

drw64

New member
Local time
6:55 AM
Messages
1
I have been studying Forensics and have encountered a problem with the $MFT file in Windows 7. I created a small text file and saved it to the root, which should appear as a resident file on the MFT, as it is under 1024 bytes. However, after copying the $MFT file and examining it in Win Hex, the newly created text file does not appear in the MFT, but is accessable and clearly in the c:/.
After more investigation, it appeared that the $MFT file had not been modified since the clean install of Windows 7, though I have created numerous folders and files since install. All of which should appear in the $MFT either as a resident or non-resident file. I performed this same routine on an XP machine and was able to find the file in $MFT.
How is 7 handling the file table differently than XP, as both use NTFS file system? Where is it located in Windows 7. Thanks in advance.
 

My Computer My Computer

At a glance

Windows 7 32 bit
OS
Windows 7 32 bit
I saw your question but can't spew NTFS details off the top of my head. I'm curious though... did you ever go back over reference material and solve your problem? Manually investigating the MFT & $MFT sounds worthwhile from a learning POV, but have you also found some freeware tools that will dump/display such data in a useful form? So that you can sanity check what you come up with manually?
 

My Computer My Computer

At a glance

Windows 7 Professional x64
OS
Windows 7 Professional x64
Back
Top