Location of MFT file?

12,348

Accessing a disk's cluster BITMAP can be read via the FSCTL_GET_VOLUME_BITMAP API call. However, it won't tell what files are at each cluster. You need either parse the MFT (faster) or recursively call FSCTL_GET_RETRIEVAL_POINTERS on each file (slow).

Share:
12,348
Usman
Author by

Usman

Updated on June 04, 2022

Comments

  • Usman
    Usman almost 2 years

    I have a partition, formatted as NTFS. I have studied that devices formatted as NTFS have a MFT (Master File Table) which contains a lot of information about the contents of a devices.

    Is MFT really a file?
    Where is it located?
    How can I view it?

    I, actually want to view the $BITMAP to know the locations of all the files and directories in a partition.

    Update: Seems like I can only view the MFT file using HexEditor. Still searching for more options though...