The NTFS file system contains a file called the master file table, or MFT. There is at least one entry in the MFT for every file on an NTFS file system volume, including the MFT itself. All information about a file, including its size, time, and date stamps, permissions, and data content, is stored either in MFT entries, or in space outside the MFT that is described by MFT entries. When files are deleted from an NTFS file system volume, their MFT entries are marked as free and may be reused.
There are several tools for parsing MFT, but MFTECmd and MFTExplorer are already enough.
Using MFTECmd:
.\MFTECmd.exe -f '.\$MFT' --csv .\
MFTECmd version 1.3.0.0
Author: Eric Zimmerman (saericzimmerman@gmail.com)
https://github.com/EricZimmerman/MFTECmd
Command line: -f .\$MFT --csv .\
File type: Mft
Processed .\$MFT in 3.7324 seconds
.\$MFT: FILE records found: 112,029 (Free records: 2,357) File size: 111.8MB
CSV output will be saved to .\20250715134834_MFTECmd_$MFT_Output.csvUsing MFTExplorer:
Info
I found the GUI easier to navigate and interact, but it took me way longer to parse data compare to the command line. But it lacks the search feature, so just use both…