A Windows GUI tool that reconstructs directory trees and analyzes FILE records from NTFS Master File Table ($MFT) files.
MFT_Browser is a Windows-based forensic tool that analyzes the NTFS Master File Table ($MFT) to reconstruct directory trees and inspect file records. It solves the problem of manually parsing complex $MFT structures by providing a graphical interface that visualizes file system metadata from disk images or live volumes.
Digital forensics investigators, incident responders, and security analysts working with Windows NTFS file systems who need to recover directory structures or examine file metadata for investigations.
Developers choose MFT_Browser for its specialized GUI that simplifies $MFT analysis without requiring scripting, its support for both extracted files and raw disk images, and its detailed record inspection with hex view correlation.
$MFT directory tree reconstruction & FILE record info
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Provides a graphical way to navigate and inspect $MFT records without command-line expertise, aligning with the project's philosophy of forensic usability.
Supports analyzing extracted $MFT files, raw disk images, and live NTFS volumes, offering flexibility for different forensic scenarios as highlighted in the key features.
Double-clicking entries reveals full MFT records with hex view synchronization, enabling precise forensic examination of metadata, as noted in the README.
Uses UTC timestamps and accurate parsing to ensure reliable metadata for investigations, emphasized in the philosophy and feature list.
Reconstructing directory trees from large MFT files can take hours due to exponential time growth, as explicitly warned in the README note, making it slow for bulk analysis.
Requires Windows with .NET Framework 4.8 and PowerShell 5.1, limiting use to specific environments and adding setup overhead for non-Windows users.
As a GUI-focused tool, it lacks built-in command-line options or APIs for batch processing, hindering integration into automated forensic workflows.