What is MFT?

Short for Master File Table, a file that contains information in the form of 1024-byte records about every other file and directory in an NTFS volume (i.e., it is essentially a table of metadata). The data stored in the MFT is what the operating system needs to retrieve the files. For example, it contains file permissions, the name and size of the file, the date and time it was created and the date and time it was modified.

NTFS reserves the first 16 records in the MFT for special metadata files, listed below:

• Record 0: metadata about the MFT itself.
• Record 1: the MFT mirror record, which is a copy of the first 16 records of the MFT.
• Record 2: the NTFS volume logging file.
• Record 3: volume partition information, such as its name, NTFS version and creation date and time.
• Record 4: metadata regarding the NTFS file attributes used on the volume.
• Record 5: a pointer to the volume root directory.
• Record 6: a map displaying which clusters on the volume are available for use.
• Record 7: a copy of the volume boot code.
• Record 8: a list of all the volume clusters that have been marked as unusable because of detected errors.
• Record 9: a table of disk quotas for NTFS 5.0 or later.
• Record 10: information for converting files to Unicode.
• Records 11-15: reserved for future metadata.

The 17th record and those following it contain information for each file and directory on the NTFS volume in order to prevent excessive disk fragmentation as file on the NTFS are added, causing the MFT to grow.