Skip to main content
DFIRLab
ResearchUse CasesCompare
Intel BriefingsThreat Actors
IOC CheckFile AnalyzerPhishing CheckDomain LookupExposure ScannerPrivacy Check
Windows MFT Analyzer
Log → SplunkLog → Sentinel
WikiAbout
PlatformNew
DFIRLab

Security research, threat intelligence, and free DFIR tools.

Tools

Phishing CheckerExposure ScannerDomain LookupFile AnalyzerPrivacy CheckLog → SplunkLog → SentinelMFT AnalyzerAPI Playground

Use Cases

SOC Phishing TriageIR IOC EnrichmentMSSP Exposure Monitoringn8n AutomationSee all use cases →

Compare

vs VirusTotalvs Shodanvs TheHiveSee all 8 →

Resources

DFIR WikiIntel BriefingsAboutPlatformAPI Docs

Legal

Privacy PolicyRSS FeedSitemap

© 2026 DFIR Lab. All rights reserved.

DFIR · Windows Forensics

Windows MFT Analyzer

Explore an NTFS Master File Table without installing anything: timestamps, full paths, deleted entries, alternate data streams, Mark-of-the-Web and resident content — parsed in your browser and searchable for IPs, domains, URLs and other indicators. The file never leaves your device.

Your $MFT never reaches our servers — nothing is uploaded, logged or storedRaw $MFT files up to 2 GB

Drag & drop an $MFT file here, or click to browse

The raw NTFS Master File Table, as collected by KAPE, FTK Imager, Velociraptor or a raw-copy tool (the file usually has no extension). Files up to 2 GB; 1 KiB and 4 KiB record sizes are detected automatically.

  • Parsed in your browser
  • Never uploaded
  • Nothing stored or logged
How It Works

From $MFT to Timeline in the Browser

1. Collect

Export the $MFT from a live system or disk image with KAPE, FTK Imager, Velociraptor or a raw-copy tool.

2. Parse locally

The browser reads the file with the File API; a Web Worker applies fixups and decodes every FILE record. No upload, no server round-trip.

3. Hunt

Filter by status, type, time range and heuristic indicators; search IPs, domains, URLs or regexes across paths, names, ADS and resident data.

What the Parser Reads

$STANDARD_INFORMATION

Created, modified, record-changed and accessed times at full 100 ns precision, plus file attributes, security ID and USN.

$FILE_NAME

Every name — Win32, DOS 8.3, POSIX and hard links — with its parent reference and its own four timestamps.

Full path reconstruction

Paths are rebuilt from parent references, including through deleted folders. Entries whose parent slot was reused are placed under \$OrphanFiles.

Deleted entries

Records whose in-use flag is cleared are listed with the metadata that survives until NTFS reuses the slot.

Alternate data streams

Named $DATA streams are listed with their sizes; resident ones can be read as text or hex.

Mark-of-the-Web

Resident Zone.Identifier streams are decoded into ZoneId, ReferrerUrl and HostUrl — often the download source of a file.

Resident data

Small files stored inside the record — scripts, .url shortcuts, $Recycle.Bin $I files — are readable and searchable, even after deletion.

Timestomp indicators

Heuristics only: $SI created earlier than $FN created, and $SI created with a zero sub-second value. Indicators, not verdicts.

Reparse points & extension records

Junction and symlink targets are decoded, other reparse tags are named, and attributes spilled into extension records are folded into their base entry.

Your $MFT never leaves this tab

  • The file is read with the browser File API and parsed in a Web Worker. There is no upload endpoint, and the analyzer makes no network requests.
  • Nothing is written to cookies, localStorage, IndexedDB or caches, and search terms never go into the URL.
  • “Clear & analyze another” — or closing the tab — terminates the worker and discards all parsed data.
  • The site’s standard page-view analytics still load; they never receive file contents or search terms.

Verify it yourself: open your browser’s developer tools on the Network tab, then load a file.

Limitations

  • Only the $MFT itself is read. The content of non-resident files lives in clusters elsewhere on the volume and is not available here — only its size.
  • $UsnJrnl, $LogFile and $I30 index slack are not parsed.
  • The timestomp and “risky extension” flags are heuristics. Installers and archive extraction routinely produce $SI < $FN with whole-second times, so expect benign hits.
  • Paths of deleted entries can be incomplete when a parent folder’s record has been reused.
  • Everything is held in browser memory, so files are limited to 2 GB. All timestamps are shown in UTC.
Related Tools

Script File Analyzer

Static analysis of suspicious HTA, VBS, JS, PowerShell and batch files — also browser-only.

IOC Reputation Check

Look up the IPs, domains and hashes you found against threat-intelligence sources.

Log → Splunk Search

Turn a raw log line into a Splunk (SPL) search built from the log’s own fields.