# MFT_Browser

MFT_Browser is a Digital Forensics product. It runs on-premises. Pricing is free.

Recreates the File/Directory tree structure from an extracted $MFT file with detailed record mapping and analysis capabilities.

Checked October 2026.

## What is MFT_Browser?

Recreates the File/Directory tree structure from an (extracted) $MFT file.
Supports both 1024 & 4096 byte long records.
Able to carve FILE records & recreate a Directory tree from a Raw Image (v.60+).
Able to extract the $MFT & recreate the Directory tree from a mounted NTFS volume (Volume must have a drive letter) (v.60+).
Latest Version: [Dependencies] .NET Framework 4.8, Powershell Version: 5.1.
'Node Properties' right-click option or Double-clicking on any file/directory entry gets the full MFT details for that record.
Clicking on any detail of the record shows the source of the detail in the Hex view grid.
All timestamps are in UTC.
Standalone GUI Calc for Dataruns: => MFT_dataruns.
Note: Recreating the directory tree from large MFT files might take a lot of time (possibly hour(s)), as it needs to map each child record to its parent node, and as the structure grows, the time needed grows exponentially.
$MFT Structures (pdf), Using MFTbrowser (pdf), How to view a single record from a large MFT file (pdf), Reparse point examples (pdf), Small test $MFT files to play with can be found on the provided links.

Tags: NTFS, MFT

## Where it fits in your security program (NIST CSF 2.0)

- [Respond](https://cybersectools.com/guides/building-respond-program-small-team): helps you contain and handle incidents.

## Quick facts

- Category: [Security Operations](https://cybersectools.com/categories/security-operations) · [Digital Forensics](https://cybersectools.com/categories/digital-forensics)
- Deployment: On-Premises
- Company size fit: Startup, SMB, Mid-Market, Enterprise
- Pricing model: Free
- GitHub stars: 325
- Website: github.com

## Where it ranks

No shortlist covers this product's category yet. The closest is [Best MDR Solutions for Business](https://cybersectools.com/shortlists/best-mdr-solutions).

## MFT_Browser FAQ

### What is MFT_Browser?

MFT_Browser is a product in the Digital Forensics category. It covers NTFS and MFT.

### What is the pricing for MFT_Browser?

MFT_Browser is free. Download and setup instructions are at https://github.com/kacos2000/MFT_Browser/.

### What are alternatives to MFT_Browser?

Alternatives to MFT_Browser listed on CybersecTools:

1. [ElcomSoft Advanced EFS Data Recovery](https://cybersectools.com/tools/elcomsoft-advanced-efs-data-recovery) - Decrypts EFS-protected files on NTFS volumes across Windows versions. (Commercial)
2. [Cyber Triage Automated Investigation Platform](https://cybersectools.com/tools/cyber-triage-automated-investigation-platform) - Automated DFIR platform for rapid incident investigation and endpoint triage (Commercial)
3. [WindowsSCOPE Cyber Forensics](https://cybersectools.com/tools/windowsscope-cyber-forensics) - GUI-based memory forensic capture tool for cyber forensics and cyber crime investigation. (Commercial)
4. [AhnLab A-FIRST 디지털 포렌식 서비스](https://cybersectools.com/tools/ahnlab-a-first-digital-forensics-service) - Digital forensics service for incident analysis and APT response (Commercial)
5. [ExtraHop Packet Forensics](https://cybersectools.com/tools/extrahop-packet-forensics) - Continuous full packet capture and forensics for network investigations (Commercial)

Compare all MFT_Browser alternatives at [https://cybersectools.com/alternatives/mftbrowser](https://cybersectools.com/alternatives/mftbrowser)

### What deployment and organization size does MFT_Browser fit?

MFT_Browser is available as on-premises. It is listed for startup, smb, mid-market and enterprise organizations. It is free.

## Compare MFT_Browser with similar solutions

- [MFT_Browser vs ElcomSoft Advanced EFS Data Recovery](https://cybersectools.com/compare/mftbrowser-vs-elcomsoft-advanced-efs-data-recovery)
- [MFT_Browser vs Cyber Triage Automated Investigation Platform](https://cybersectools.com/compare/cyber-triage-automated-investigation-platform-vs-mftbrowser)
- [MFT_Browser vs WindowsSCOPE Cyber Forensics](https://cybersectools.com/compare/mftbrowser-vs-windowsscope-cyber-forensics)

All alternatives to MFT_Browser: [/alternatives/mftbrowser](https://cybersectools.com/alternatives/mftbrowser)

---

Source: https://cybersectools.com/tools/mftbrowser

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on MFT_Browser: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md