Where is the MFT for NTFS?

Posted on 2009-04-19
Medium Priority
Last Modified: 2013-12-28
I want to know where is the MFT file for my drive(s). I know that there are free HEX editor that can open the MFT. But I am just wondering where it is and if you can programmatically read it in .net(C#/VB) or JAVA

Thanks in advance!
Question by:roychan0328
  • 2
  • 2
LVL 86

Expert Comment

ID: 24180866
You'll find a lot of useful information at http://www.ntfs.com/ - and http://www.codeproject.com/KB/files/NTFSUndelete.aspx ("Undelete a file in NTFS") has some sample code on how to handle the MFT and it's entries.

Author Comment

ID: 24181020
Thanks for the quick response. I have read both links. What I am trying to do is to read the $mft programatically.

It seems to me that C# can't really do it. you have to use C/C++, if you use C#, I think you have to use P/Invoke. which I believe the overhead is high...(from what I read on the net so far)

So... is there a way to read $mft directly from C# or Java?

LVL 86

Accepted Solution

jkr earned 2000 total points
ID: 24181046
Well, either way you'd have to call Win32 APIs, so we're back at P/Invoke...

Author Closing Comment

ID: 31572041
super responsive!
LVL 39

Expert Comment

ID: 24181164
Unfortunately, this thread is already closed.  Jkr was right about the Win32 APIs, but it is not really hard to do.. and as with many things, if somebody else has already done it..... For the sake of the archive and for anybody interested, here's a solution: check this post on the social MSDN forum for how to do it.

Featured Post

[Webinar] Cloud and Mobile-First Strategy

Maybe you’ve fully adopted the cloud since the beginning. Or maybe you started with on-prem resources but are pursuing a “cloud and mobile first” strategy. Getting to that end state has its challenges. Discover how to build out a 100% cloud and mobile IT strategy in this webinar.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Windows Server 2003 introduced persistent Volume Shadow Copies and made 2003 a must-do upgrade.  Since then, it's been a must-implement feature for all servers doing any kind of file sharing.
The article covers five tools all IT professionals should know about, as they up productivity by a great deal!
The viewer will be introduced to the member functions push_back and pop_back of the vector class. The video will teach the difference between the two as well as how to use each one along with its functionality.
Finding and deleting duplicate (picture) files can be a time consuming task. My wife and I, our three kids and their families all share one dilemma: Managing our pictures. Between desktops, laptops, phones, tablets, and cameras; over the last decade…

807 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question