Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.

Windows 7: $MFT Change?

21 Oct 2011   #1

Windows 7 32 bit
$MFT Change?

I have been studying Forensics and have encountered a problem with the $MFT file in Windows 7. I created a small text file and saved it to the root, which should appear as a resident file on the MFT, as it is under 1024 bytes. However, after copying the $MFT file and examining it in Win Hex, the newly created text file does not appear in the MFT, but is accessable and clearly in the c:/.
After more investigation, it appeared that the $MFT file had not been modified since the clean install of Windows 7, though I have created numerous folders and files since install. All of which should appear in the $MFT either as a resident or non-resident file. I performed this same routine on an XP machine and was able to find the file in $MFT.
How is 7 handling the file table differently than XP, as both use NTFS file system? Where is it located in Windows 7. Thanks in advance.

My System SpecsSystem Spec
23 Oct 2011   #2

Windows 7 Professional x64

I saw your question but can't spew NTFS details off the top of my head. I'm curious though... did you ever go back over reference material and solve your problem? Manually investigating the MFT & $MFT sounds worthwhile from a learning POV, but have you also found some freeware tools that will dump/display such data in a useful form? So that you can sanity check what you come up with manually?
My System SpecsSystem Spec

 $MFT Change?

Thread Tools

Similar help and support threads
Thread Forum
Change Admin Name doesnt change path name
Hello, my admin name is Mike and lets say my file path name is C:\Users\Mike\AppData and I want to change the name Mike to Chad which is easy but my file path still stays C:\Users\Mike\AppData how do I get it to change to C:\Users\Chad\AppData. Thanks,
General Discussion
All icon change to WMP and all target type change to EXE File
hey guyss..i have problem with my computer....all my icon change to Windows media player and all target type change to EXE File...what should i do.....plzzz... #sorry for my bad english.. Windows 7 Ultimate 32 bit sp1 2 gb ram
General Discussion
Dell Inspirion 1525 BSOD No hardware change or software change
BSOD happened today and was wondering was there a solution for this problem. I don't know why the issue has come up as now.
BSOD Help and Support
Change the message on start up.How do you change it?
Hi. When I start up my computer,it says "protected by Avast".Its possible that this was there after I first instaled avast a few days after buying and using my computer.This computer had nortons internet security 2012 ipre installed when I bought it in June 2012. I added these after I bought...
System Security
How to change fonts for menus and change --->
I'm looking for a way to change the background color of windows, menu fonts, etc. In XP there was a way to right click on desktop and go into advance display settings. Can someone point me the way on how to do this in 7? Thanks

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 10:31.
Twitter Facebook Google+ Seven Forums iOS App Seven Forums Android App