MFT Browser
A Windows GUI tool that reconstructs directory trees and analyzes FILE records from NTFS Master File Table ($MFT) files.
What is MFT Browser?
MFT_Browser is a Windows-based forensic tool that analyzes the NTFS Master File Table ($MFT) to reconstruct directory trees and inspect file records. It solves the problem of manually parsing complex $MFT structures by providing a graphical interface that visualizes file system metadata from disk images or live volumes.
Digital forensics investigators, incident responders, and security analysts working with Windows NTFS file systems who need to recover directory structures or examine file metadata for investigations.
Developers choose MFT_Browser for its specialized GUI that simplifies $MFT analysis without requiring scripting, its support for both extracted files and raw disk images, and its detailed record inspection with hex view correlation.
Overview
$MFT directory tree reconstruction & FILE record info
Use Cases
Best For
- Reconstructing directory trees from compromised or corrupted NTFS volumes
- Analyzing $MFT files extracted during forensic investigations
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
