What is mft?

Master File Table (MFT)

The Master File Table (MFT) is a critical component of the <a href="https://www.wikiwhat.page/kavramlar/NTFS%20(New%20Technology%20File%20System)" target="_blank">NTFS (New Technology File System)</a> file system used by Windows operating systems. It can be thought of as an index or directory that contains metadata and information about every file and directory on an NTFS volume. Without the MFT, the file system would be unable to locate and access files.

Key Information:

• Purpose: The MFT stores information about all files and directories, including their names, sizes, timestamps (creation, modification, access), permissions, data attributes (like compression and encryption), and where the file's data is located on the disk (in the form of <a href="https://www.wikiwhat.page/kavramlar/cluster" target="_blank">cluster</a> numbers).

• Structure: The MFT is essentially a database composed of file records. Each file or directory on the volume has at least one corresponding file record in the MFT. Small files (generally those fitting entirely within the MFT record itself) are considered resident and have their data stored directly in the MFT record. Larger files are considered non-resident; the MFT record then contains pointers to the locations of the file's data clusters on the disk.

• File Record Format: Each MFT record typically has a fixed size (e.g., 1KB or 4KB). This record contains various attributes, which are structured metadata about the file. Common attributes include:

  • $STANDARD_INFORMATION: Contains standard file information, such as timestamps and attributes.
  • $FILE_NAME: Contains the file's name and namespace.
  • $DATA: Contains the file's data, if resident, or pointers to the data if non-resident.
  • $INDEX_ROOT and $INDEX_ALLOCATION: Used for directories, pointing to the directory's index entries.

• Location: The MFT is usually located near the beginning of the NTFS volume. Its location is described in the <a href="https://www.wikiwhat.page/kavramlar/boot%20sector" target="_blank">boot sector</a> of the volume. The second copy of MFT is located in the middle of the harddrive.

• Importance: The MFT is crucial for file system integrity. If the MFT is corrupted or damaged, it can lead to data loss, inaccessible files, and other serious issues.

• Security: The MFT itself is protected, and its access is usually restricted to system-level processes.

• MFT Mirror (MFTMirr): For redundancy, NTFS maintains a backup copy of the MFT called the MFT Mirror (MFTMirr). This mirror is typically located in the middle of the volume. If the primary MFT is corrupted, the file system can attempt to use the MFT Mirror to recover.

• File Number 0: The first entry in the MFT (file number 0) describes the MFT itself.

• Fragmentation: Over time, the MFT can become fragmented, which can slow down file system access. Defragmentation tools can help consolidate the MFT and improve performance.