Where does Encase search to recover NTFS files and folders?
A. MBR
B. MFT
C. Slack space
D. HAL
One Comment on “Where does Encase search to recover NTFS files and folders?”
jansen9says:
MFT (Master File Table): a database in which information about every file and directory on NTFS logical volume is stored.
Each record contains attributes that tell OS how to deal with the file or directory associated with the record.
MFT (Master File Table): a database in which information about every file and directory on NTFS logical volume is stored.
Each record contains attributes that tell OS how to deal with the file or directory associated with the record.