mft.records

$ target-query <path/to/target> -f mft.records
Details

Module

dissect.target.plugins.filesystem.ntfs.mft.MftPlugin

Output

records

Module documentation

NTFS MFT plugin.

Function documentation

Return the MFT records of all NTFS filesystems.

The Master File Table (MFT) contains primarily metadata about every file and folder on a NFTS filesystem.

If the filesystem is part of a virtual NTFS filesystem (a VirtualFilesystem with the MFT properties added to it through a “fake” NtfsFilesystem), the paths returned in the MFT records are based on the mount point of the VirtualFilesystem. This ensures that the proper original drive letter is used when available. When no drive letter can be determined, the path will show as e.g. \$fs$\fs0.

References: