Explore an NTFS Master File Table without installing anything: timestamps, full paths, deleted entries, alternate data streams, Mark-of-the-Web and resident content — parsed in your browser and searchable for IPs, domains, URLs and other indicators. The file never leaves your device.
Drag & drop an $MFT file here, or click to browse
The raw NTFS Master File Table, as collected by KAPE, FTK Imager, Velociraptor or a raw-copy tool (the file usually has no extension). Files up to 2 GB; 1 KiB and 4 KiB record sizes are detected automatically.
Export the $MFT from a live system or disk image with KAPE, FTK Imager, Velociraptor or a raw-copy tool.
The browser reads the file with the File API; a Web Worker applies fixups and decodes every FILE record. No upload, no server round-trip.
Filter by status, type, time range and heuristic indicators; search IPs, domains, URLs or regexes across paths, names, ADS and resident data.
Created, modified, record-changed and accessed times at full 100 ns precision, plus file attributes, security ID and USN.
Every name — Win32, DOS 8.3, POSIX and hard links — with its parent reference and its own four timestamps.
Paths are rebuilt from parent references, including through deleted folders. Entries whose parent slot was reused are placed under \$OrphanFiles.
Records whose in-use flag is cleared are listed with the metadata that survives until NTFS reuses the slot.
Named $DATA streams are listed with their sizes; resident ones can be read as text or hex.
Resident Zone.Identifier streams are decoded into ZoneId, ReferrerUrl and HostUrl — often the download source of a file.
Small files stored inside the record — scripts, .url shortcuts, $Recycle.Bin $I files — are readable and searchable, even after deletion.
Heuristics only: $SI created earlier than $FN created, and $SI created with a zero sub-second value. Indicators, not verdicts.
Junction and symlink targets are decoded, other reparse tags are named, and attributes spilled into extension records are folded into their base entry.
Verify it yourself: open your browser’s developer tools on the Network tab, then load a file.
Static analysis of suspicious HTA, VBS, JS, PowerShell and batch files — also browser-only.
Look up the IPs, domains and hashes you found against threat-intelligence sources.
Turn a raw log line into a Splunk (SPL) search built from the log’s own fields.