Skip main navigation

MFT Record Attributes

Article detailing an overview of NT File System $MFT file segment entry (record) attributes of interest to the Malware Investigator.
© PA Knowledge Ltd | 7Safe Training

MFT Record Attributes

File metadata is stored within various attributes within each MFT record. Each attribute is uniquely identified by a header followed by attribute information. The number of attributes assigned to an MFT record depends on whether it pertains to a file or a directory and what additional metadata needs to be applied to that file or directory.

The following file attributes are of interest to the malware investigator:

Attribute Header Attribute Name
0x10 $STANDARD_INFORMATION
0x30 $FILE_NAME
0x40 $OBJECT_ID
0x80 $DATA

A snippet of an MFT record containing the above attributes is detailed below:

Screenshot of $MFT file segment entry attributes.

The above MFT entry is displayed in hexadecimal format and these values are decoded and referenced in a template on the left together with an ASCII interpretation on the right.

Additional information…

Attribute headers will only start on an 8 byte boundary. A raw view of the above MFT entry without the use of templates is detailed below. See if you can identify the header and the 4 file attributes in question?

Snippet of raw $MFT file segment entry.

Interestingly you may have noted that the offset displayed in the above image is in an hexadecimal format whilst the templated view is displayed in a decimal format. The data relating to the actual MFT entry itself is of course identical.

© PA Knowledge Ltd | 7Safe Training
This article is from the free online

Introduction to Digital Forensics: Malware Analysis and Investigations

Created by
FutureLearn - Learning For Life

Our purpose is to transform access to education.

We offer a diverse selection of courses from leading universities and cultural institutions from around the world. These are delivered one step at a time, and are accessible on mobile, tablet and desktop, so you can fit learning around your life.

We believe learning should be an enjoyable, social experience, so our courses offer the opportunity to discuss what you’re learning with others as you go, helping you make fresh discoveries and form new ideas.
You can unlock new opportunities with unlimited access to hundreds of online short courses for a year by subscribing to our Unlimited package. Build your knowledge with top universities and organisations.

Learn more about how FutureLearn is transforming access to education