MFT record layout

• The MFT record is of a fixed size (1 KiB) that starts with a fixed header containing:

• • • Unique signature string 'FILE'
    • Sequence, generation and 'fixup' information
    • Offset to first dynamic attribute in the record (0x38)
    • Type of the MFT-record, either File or Directory

• After this a dynamic list of variable sized attributes follows, these can be either:

• • • Internal (Self contained) when small
    • External, using an allocation run-list pointing to one or more clusters being used for the data