MFT
Generated by scripts/gen-format-pages.py from docs/data/format-metadata/, FILE_FORMATS.csv and docs/formats-master.csv. Do not edit by hand: change the source, then run the script.
NTFS MFT Preview.
At a glance
| Purpose | An NTFS master file table ($MFT): fixed-size FILE records describing every file and directory with their attributes. |
| Extensions | .mft |
| Poka parser | poka-mft |
| Viewer | poka-tree-viewer |
| Depth tier | Parser with a shared viewer (see Depth tiers) |
| Breadth tier | B3 Core (see Breadth tiers) |
How much Poka reads
B3 Core. Only the main content type or types are decoded (for example geometry but not materials, layers or annotations, or only one version family). The list of gaps is substantial.
Confidence: medium (the reviewer read the code). Basis: Reviewed 2026-10-26: read parsers/poka-mft/src/main.rs (638 lines) and plugin.json. No unit tests or tests/samples.rs; the corpus has ez_NIST_DFR-16.mft, read by no test. Covers .mft. The tree walks the FILE records and shows counts (records, in use, directories, record size) and for listed records the file name, namespace, parent reference, type, in-use flag, $DATA and $FILE_NAME sizes and created and modified times. Judgement: B3: records are decoded, but only a sample is listed and no path tree is built.
What Poka does not read
- Only the first 500 records are listed
- Full paths are not rebuilt from parent references
- The update-sequence fixups are not applied, so values at sector ends can be wrong (judgement from the code)
- Attributes other than $STANDARD_INFORMATION, $FILE_NAME and $DATA are not decoded
- Resident file content is not shown
Libraries
Libraries Poka uses or has assessed for this format, with the status, licence and language the registry records.
- mft (candidate; MIT OR Apache-2.0; Rust; https://github.com/omerbenamram/mft) — NTFS Master File Table
- ntfs (candidate; MIT OR Apache-2.0; Rust; https://github.com/ColinFinck/ntfs)
Sources
- parsers/poka-mft/src/main.rs
- parsers/poka-mft/plugin.json