NTFS
| Format | NTFS |
|---|---|
| Short name | NTFS |
| Category | filesystem |
| Platforms | Windows |
| Crush support | Supported (RawImageVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
The Windows filesystem. Every file and directory is an entry in the Master File Table ($MFT) with attributes such as $STANDARD_INFORMATION and $FILE_NAME, each holding its own set of four timestamps (100 ns since 1601 UTC); $STANDARD_INFORMATION times can be set through the API, $FILE_NAME times not readily, so comparing both helps detect timestomping. Small files are stored resident inside the MFT entry, and entries of deleted files remain until reused. Metadata files record history — $LogFile (transaction log), $UsnJrnl:$J (change journal) — next to $Secure (security descriptors) and $Bitmap (cluster allocation). Alternate data streams (e.g. Zone.Identifier) and Volume Shadow Copies live on the same volume.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 3 (0x3) | 4E 54 46 53 20 20 20 20 | NTFS | OEM identifier 'NTFS ' in the boot sector |
Known extensions
None recorded
References
- New Technologies File System (NTFS) — format documentation (libyal/libfsntfs) https://github.com/libyal/libfsntfs/blob/main/documentation/New%20Technologies%20File%20System%20(NTFS).asciidoc
- ForensicsWiki — New Technology File System (NTFS) https://forensics.wiki/new_technology_file_system_(ntfs)/
- abrignoni/qnxprobe — MBR/GPT, LVM2 and filesystem reader for raw images (QNX6/QNX4, ETFS, EFS, ext2/3/4, F2FS, FAT32/16/12, exFAT, NTFS, HFS+, APFS, QNX IFS, SquashFS, JFFS2, UBI/UBIFS, YAFFS) https://github.com/abrignoni/qnxprobe
Cite this entry
Crush Format Reference, “NTFS”. https://kalink0.github.io/crush-forensics/formats/ntfs/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction