Locating $mft

[mjf]

I'm trying to locate some files including $mft.
Can anyone tell me how to locate $mft

 

[logicearth]

And how are you going about locating these files?

 

[mjf]

And how are you going about locating these files?

that's basically the question

 

[The Howling Wolves]

Why don't you just go to start/type in $mft in search box?
Maybe you don't have any in your system.
I have several as they are from dump files doing BSODs

 

[mjf]

I've searched at the command prompt
dir /a
as I thought these meta files were accessible from the root.

Also used "(Search) Everything"

Physically I thought the Master File table followed the Boot sector of the volume.

 

[logicearth]

You will not see these files though explorer or the command line, you have to go deeper into the kernel of Windows. Talk directly with the file system driver. I know of no program that would do that.

 

[scrotiny]

You will not see these files though explorer or the command line, you have to go deeper into the kernel of Windows. Talk directly with the file system driver. I know of no program that would do that.

The program Directory Snoop (not free) allows the user to view the content of metafiles like $mft and others. Quite useful as it also can recover deleted files and wipe files where necessary.

 

[Bill2]

The closest I've found is ntfsinfo tool from sysinternals. This is the kind of report it generates.



Download link here:

NTFSInfo

 

[scrotiny]

I'm trying to locate some files including $mft.
Can anyone tell me how to locate $mft

If you mean the physical location on the disk then some defraggers might do this - PerfectDisk will for instance.

 

[mjf]

@Bill2
thanks. I had ntfsinfo.
I thought it basically read the hidden file $mft in c:\
I wanted to be able to see it and read it. I can't do either.

@Scotiny,
thanks, "defraggler" shows the physical location (like ntfsinfo).

My initial post did just says locate - my fault.

 

[Bill2]

You need low level access- try a file recovery program like Recuva.

 

[Lipchen]

Hello

You should probabaly be using a program called FTK Imager to create an image of your hard-drive. Then analysing this image using such software as EnCase or FTK.

Here is a video of how to manually locate the NTFS metafiles:
Forensics: What is $Boot? « Where is Your Data?

 

[mjf]

Thanks Lipchen. That's a nice detailed explanation you pointed me to.