Microsoft® Windows® 2000 Security Handbook

The Master File Table (MFT)

The MFT is created and initialized when an NTFS volume is formatted. The MFT consists of an array of 1KB records. Each record identifies a single file contained within the volume. When a file is created, NTFS first looks for an empty slot in the MFT and subsequently fleshes out the record with all the appropriate data for the new file.

Think of the MFT as the index for the file system. Each and every file and directory has a 1KB entry in the MFT that, if necessary, points to additional storage on the volume. I'll be talking much more about the MFT in the following pages. Figure 4.1 shows what a typical MFT entry looks like.

Figure 4.1. MFT record contents