Source: Juni_2026_Exams/Advance_Forensics/notes/04-mft-explorer-workflow.md

🗂️ MFT Explorer Workflow Guide

What is MFT?

$MFT (Master File Table) is the heart of NTFS. It contains metadata about every file ever on the drive, including deleted files.

Key fact: Deleted files aren't truly deleted from MFT — their entry is marked as deleted but still visible.

🎯 What MFT Tells Us

For each file, MFT stores:

Item	What it means
Filename	The file's name
Parent Directory	Where the file was located
Created (C)	File creation time
Modified (M)	Last modification time
Accessed (A)	Last access time
MFT Changed (B)	When MFT entry changed
File Size	Size in bytes
Deleted	Flag indicating deletion

🚀 Step-by-Step: Using MFT Explorer

Step 1: Open MFT Explorer

Launch MFT Explorer:
Program: ExplorerSuite
Tool: MFT Explorer
OR: Direct executable (usually in Program Files)

Step 2: Load $MFT File

1. File → Open (or Ctrl+O)
2. Select $MFT file (exported from FTK Imager)
3. Click: Open
4. Wait: MFT Explorer loads (may take 30+ seconds for large drives)
5. Status bar shows: "Ready" when complete

Step 3: Interface Overview

Left pane: Navigation/filters
Right pane: File list

Columns shown:
├── Entry Number (MFT record ID)
├── Filename
├── Parent Entry (points to folder MFT record)
├── Created (FILETIME)
├── Modified (FILETIME)
├── Accessed (FILETIME)
├── MFT Modified (FILETIME)
├── Size
├── Flags (deleted, etc.)
└── Full Path

🔍 How to Find Deleted Files

Method 1: Filter by Deleted Files

1. View menu → Filter
   OR: Right side panel "Flags"

2. Check: "Show deleted entries"
   OR: Uncheck "Show allocated entries"

3. View changes to show only deleted files

4. Scroll or search through results

Method 2: Search by Filename

1. Ctrl+F (Find)
2. Enter filename: e.g., "malware.exe"
3. Include: Deleted flag checkbox
4. Search
5. Results show all matches (deleted + existing)

Method 3: Search by Date Range

1. Filter → Date Range
2. Set: From date → To date
3. Select: Modified OR Accessed OR Created
4. View files modified in that timeframe
5. Look for suspicious files

Method 4: Search by File Size

1. View → Column headers
2. Sort by: File Size
3. Look for:
   - Unusually large files (could be bulk stolen data)
   - Unusually small files (scripts, executables)

📍 Finding Original File Location

Using Parent Entry

When you find a deleted file:
1. Note the Parent Entry number (e.g., 5432)
2. Search for that Entry number
3. It points to the folder it was in
4. Full path is shown in "Full Path" column

Example:
├── Deleted file: malware.exe
│   Parent Entry: 5432
│   [Search for entry 5432]
├── Result: Entry 5432 = C:\Users\John\Downloads
└── Conclusion: File was at C:\Users\John\Downloads\malware.exe

Reading Full Path Column

MFT Explorer shows full path directly:
├── Entry: 1234
├── Filename: malware.exe
└── Full Path: C:\Users\John\AppData\Local\Temp\malware.exe

⏱️ Understanding MFT Timestamps

Four Timestamps (MACB)

Letter	What	Meaning
M	Modified	When file content changed
A	Accessed	When file was read
C	Created	When file was created
B	MFT Changed	When MFT entry changed

Timestamp Values

Format: Windows FILETIME (100-nanosecond intervals since January 1, 1601)

Example:

Created: 132531014400000000
→ Converted with DCode
→ 2021-08-09 14:40:00 UTC

Timeline Analysis

If you see:
├── Created:  2021-08-09 14:40 (file created)
├── Modified: 2021-08-09 14:42 (file modified 2 min later)
├── Accessed: 2021-08-10 08:30 (file read next day)
└── MFT Changed: 2021-08-11 10:00 (metadata updated)

Interpretation: File created, modified, then deleted/moved

🎯 Practical Exam Scenarios

Scenario 1: Find Deleted Malware

Question: "Where was the deleted file 'backdoor.exe' originally?"

Steps:
1. Search for: backdoor.exe (with deleted filter)
2. Find result: Entry 12345
3. Note: Parent Entry 5432, Full Path shows C:\Windows\Temp
4. Copy timestamps
5. Answer: C:\Windows\Temp\backdoor.exe (deleted on 2021-08-10)

Scenario 2: Timeline Reconstruction

Question: "Create timeline of file system activity"

Steps:
1. Sort by: Modified timestamp
2. List all modifications between dates X and Y
3. Note: Files created, modified, deleted
4. Identify suspicious activity pattern
5. Answer: Chronological list of activities

Scenario 3: Find Hidden Malware Script

Question: "Find any .ps1 (PowerShell) scripts"

Steps:
1. Search for: *.ps1
2. Include deleted files
3. List all results
4. Check Modified dates (created when?)
5. Answer: All .ps1 files with locations

📋 MFT Information Checklist

For every deleted file you find:

[ ] Filename - What was it called?
[ ] Location - Where was it? (Full path)
[ ] Date Created - When was it first created?
[ ] Date Modified - When was it last changed?
[ ] Date Accessed - When was it last opened?
[ ] File Size - How big was it?
[ ] Deleted When - Use MFT Changed date as proxy
[ ] Parent Folder - Still exists or also deleted?

💡 Common Exam Questions About MFT

Q: "What files were deleted?"

Answer: Filter for deleted entries, list with timestamps

Q: "Find the malicious file's original location"

Answer: Search MFT, use Full Path column

Q: "What's the timeline of this file?"

Answer: Show Created → Modified → Accessed → Deleted timeline

Q: "When was the system last used?"

Answer: Find most recent Accessed or Modified timestamp

Q: "Which files were accessed after deletion?"

Answer: Find files with Accessed > Deleted marker timestamp

⚠️ Limitations & Gotchas

Gotcha 1: Timestamp Confusion

Created (C): Original creation, not recovery creation
Wrong: "Created date shows when file was recovered"
Right: "Created date shows when file was originally made"

Gotcha 2: Deleted Marker

Not all deleted files show "deleted" flag
Some may be in Unallocated Space
MFT entry might be reused
Workaround: Look for anomalies (size 0, orphaned files)

Gotcha 3: File Carving

MFT shows file metadata
Actual file content may be overwritten
Implication: You can find what was deleted, but not always recover it

Gotcha 4: Parent Entry Missing

If parent folder also deleted, parent entry may be gone
Workaround: Search by filename instead, or use other artifacts

🛠️ Practical Workflow

Complete MFT Analysis Workflow

Step 1: Export $MFT from forensic image (FTK Imager)
        └─ Destination: D:\Evidence\MFT\$MFT

Step 2: Open MFT Explorer

Step 3: Load $MFT file
        └─ File → Open → D:\Evidence\MFT\$MFT

Step 4: Identify objectives
        ├─ Find specific deleted files?
        ├─ Create timeline?
        └─ Find suspicious activity?

Step 5: Filter appropriately
        ├─ Show deleted files
        ├─ Filter by date range
        └─ Filter by file type

Step 6: Search and document findings
        ├─ Note filenames
        ├─ Note full paths
        ├─ Copy timestamps
        └─ Take screenshots

Step 7: Cross-reference with other artifacts
        ├─ Check Registry for persistence
        ├─ Check LNK files for access
        └─ Check timeline for correlation

Step 8: Write answer using template
        └─ Include paths, timestamps, context

🎓 Quick Reference Card

What to Remember

$MFT = List of ALL files + deleted files
Deleted files = Entry marked deleted, data may be overwritten
Parent Entry = Link to folder (shows original location)
Timestamps = 4 types (MACB), use DCode to convert
Full Path = Direct path shown in column (easiest method)

How to Find

Malware location?     → Search MFT, use Full Path
When was it deleted?  → Use MFT Changed timestamp
What files exist?     → Load $MFT, filter not-deleted
Timeline?             → Sort by Modified, list chronologically
Hidden files?         → Search for extension (.exe, .ps1)

🎯 Practice Exercises

Exercise 1: Find Deleted Executable

1. Open $MFT
2. Search: *.exe (with deleted filter)
3. Find at least 3 deleted .exe files
4. Note their original paths
5. Time: 5 min

Exercise 2: Create Timeline

1. Load $MFT
2. Sort by Modified timestamp
3. List 10 files modified on a specific date
4. Time: 5 min

Exercise 3: Find Hidden PowerShell Script

1. Load $MFT
2. Search: *.ps1
3. Note locations and dates
4. Time: 3 min

Exercise 4: Correlate with Forensics

1. Load $MFT
2. Find deleted file: malware.exe
3. Get: Path, Created, Modified, Size
4. Later: Cross-check with Registry persistence
5. Time: 10 min

📝 Exam Answer Template for MFT

Question: Find all deleted suspicious files

Tool: MFT Explorer
Evidence: $MFT

Steps:
1. Loaded $MFT in MFT Explorer
2. Filtered for deleted entries
3. Searched for *.exe extensions
4. Found [number] deleted files

Results:
┌────────────────────────────────────────┐
│ File: malware.exe                      │
│ Location: C:\Windows\Temp              │
│ Created: 2021-08-09 14:40 UTC         │
│ Modified: 2021-08-09 14:42 UTC        │
│ Size: 245 KB                          │
│ Status: DELETED                        │
└────────────────────────────────────────┘

Answer: Found 3 deleted executables in suspicious locations

Last Updated: June 15, 2026