What is a Master File Table?

Written by Tony Landry, Updated on October 06, 2023

Master File Table

Master File Table or MFT is a system file in the NTFS file system used by Windows OS that keeps all the information about the files and directories and acts as an index on the NTFS disk, providing quick access to the information needed to retrieve a file.

Every file and directory on an NTFS disk has a unique record in the MFT, known as an MFT entry. The entry contains metadata like name, permissions, timestamps, and a pointer to the data of the file. The MFT entry is modified every time when a new file is created or an existing file is modified.

When a file is deleted from the disk, the respective MFT entry is marked free, but the actual data is still residing on the disk until it gets overwritten by other data. This can help in recovering deleted files. However, to recover them, we shouldn't save anything new over the old data areas.

MFT is a very important component in the NTFS file system, it must remain safe and undamaged for the proper functionality of the disk.

Structure of MFT

The structure of the MFT record is very complex, and each record is 1024 bytes, so they can be easily parsed. The general structure of MFT is:

  • File Record Header: Contains information about the record itself, such as size, update sequence offset, and flags indicating the file or directory's state.
  • File Attribute List: Contains attributes describing the file or directory, including name, timestamps, size, and data. Each attribute has its own structure and format.
  • Data Runs: Describes the location of the file or directory's data on the disk, specifying starting clusters and lengths of contiguous data blocks. Data runs are stored as a series of extents.

NOTE: dir /a $mft - This command yields the current size of the MFT on a Windows NT–based computer. The command should be typed on NTFS volume.

Corruption of Master File Table

When MFT gets corrupt, NTFS synchronizes the copy of MFT i.e. MFT mirror. Sometimes when NTFS is unable to synchronize; the CHKDSK (check disk) utility can be used. In certain cases, when the MFT is severely damaged and even CHKDSK fails to repair MFT, NTFS recovery software can be used.

Related Information

Recover files from NTFS - The Master File Table can be damaged due to a virus attack, resulting in missing/lost files and folders from the NTFS partition. You might lose important files under such conditions. You need not worry about the loss, as the article provides an easy recovery option.

Complete Data Recovery Software

Why Choose Remo?

100% safeSecure

100% SatisfactionGuarantee

10 Million+Downloads

Free TechSupport

Live Chat24/7 Support

Top