MFT_Browser
Recreates the File/Directory tree structure from an extracted $MFT file with detailed record mapping and analysis capabilities.
Recreates the File/Directory tree structure from an extracted $MFT file with detailed record mapping and analysis capabilities.
Checked October 2026.
Recreates the File/Directory tree structure from an (extracted) $MFT file. Supports both 1024 & 4096 byte long records. Able to carve FILE records & recreate a Directory tree from a Raw Image (v.60+). Able to extract the $MFT & recreate the Directory tree from a mounted NTFS volume (Volume must have a drive letter) (v.60+).
Latest Version: [Dependencies] .NET Framework 4.8, Powershell Version: 5.1. 'Node Properties' right-click option or Double-clicking on any file/directory entry gets the full MFT details for that record. Clicking on any detail of the record shows the source of the detail in the Hex view grid.
All timestamps are in UTC. Standalone GUI Calc for Dataruns: => MFT_dataruns. Note: Recreating the directory tree from large MFT files might take a lot of time (possibly hour(s)), as it needs to map each child record to its parent node, and as the structure grows, the time needed grows exponentially. $MFT Structures (pdf), Using MFTbrowser (pdf), How to view a single record from a large MFT file (pdf), Reparse point examples (pdf), Small test $MFT files to play with can be found on the provided links.
No core features are listed for this product yet, so check the vendor's documentation for the full feature list.
No integrations are listed for this product yet. Check the vendor's documentation, or ask the vendor which integrations and APIs it supports.
Common questions about MFT_Browser: features, pricing and alternatives.
MFT_Browser is a product in the Digital Forensics category. It covers NTFS and MFT.
MFT_Browser is free. Download and setup instructions are at https://github.com/kacos2000/MFT_Browser/.
Alternatives to MFT_Browser listed on CybersecTools:
Compare all MFT_Browser alternatives at https://cybersectools.com/alternatives/mftbrowser
MFT_Browser is available as on-premises. It is listed for startup, smb, mid-market and enterprise organizations. It is free.
Side by side: features, pricing model and the company behind each one.
View physical memory as files in a virtual file system for easy memory analysis and artifact access.
Browser session recording & forensics for incident investigation & analysis
Review of various MFT parsers used in digital forensics for analyzing NTFS file systems.
A command-line tool for managing and analyzing Microsoft Forefront TMG and UAG configurations.
A tool for parsing and extracting information from the Master File Table of NTFS file systems.
A forensic toolkit for analyzing Android and iOS devices to detect potential spyware infections and security compromises using indicators of compromise.
On our shortlist?
No shortlist covers this product's category yet. The closest is Best MDR Solutions for Business.
Get a summary of this page from your assistant.
Mandos MCP: ask about all 9,025 products.
Connect your AI
