NTFS MFT Viewer

The NTFS MFT Viewer analyzes a Master File Table dump by parsing each MFT record, extracting key attributes, and presenting a structured view of file references, sizes, and timestamps. It supports decoding UTF-16LE file names and translating FILETIME values to UTC, enabling investigators to trace file activity, identify deleted or orphaned records, and verify filesystem consistency across multiple entries.
Core outputs include a structured dataset of MFT records, a timeline of file activity, and cross-referenced parent-child relationships. The tool can export results as JSON or CSV for integration with analysis pipelines or SIEMs. It handles corrupted records gracefully, logging anomalies while continuing analysis, and it can limit scope to a specified MFT entry range to keep results focused on relevant sections.
Beneficiaries include forensics teams, incident responders, and data engineers who need fast, repeatable MFT analysis without starting a full disk-imaging workflow. The unique value lies in robust attribute decoding, accurate time normalization, and flexible export options that support offline casework, archival audits, and documentation of findings.