![SANS Digital Forensics and Incident Response Blog | Resident $DATA Residue in NTFS MFT Entries | SANS Institute SANS Digital Forensics and Incident Response Blog | Resident $DATA Residue in NTFS MFT Entries | SANS Institute](https://images.contentstack.io/v3/assets/blt36c2e63521272fdc/blt013c2c3e35e5e5d9/5e500fcf6148a40d93318b39/Screenshot-mft-nonresident-GHex.png)
SANS Digital Forensics and Incident Response Blog | Resident $DATA Residue in NTFS MFT Entries | SANS Institute
![windows 7 - Explorer.exe is accessing $Mft (NTFS Master File Table) and causing excessive hard disk grinding in a directory containing ~10,000,000 files - Super User windows 7 - Explorer.exe is accessing $Mft (NTFS Master File Table) and causing excessive hard disk grinding in a directory containing ~10,000,000 files - Super User](https://i.stack.imgur.com/RBhir.png)
windows 7 - Explorer.exe is accessing $Mft (NTFS Master File Table) and causing excessive hard disk grinding in a directory containing ~10,000,000 files - Super User
![Forensic Investigation-Explore Master File Table (MFT)records, File Metadata to find digital crimes | by Mr.Vic | Medium Forensic Investigation-Explore Master File Table (MFT)records, File Metadata to find digital crimes | by Mr.Vic | Medium](https://miro.medium.com/v2/resize:fit:1400/1*Ssn0VbhiiftnEBjICyzFVQ.png)