Master File Table (MFT): cos’è e come viene utilizzata dal file system NTFS
Il Tabella file master (MFT) is an NTFS system file containing records that describe the files and folders on a volume. These records hold metadata, such as filenames and timestamps, and information needed to retrieve file contents. Windows uses the table to locate and manage files on NTFS-formatted storage.
Il Tabella file master NTFS belongs to the Sistema di file NTFS. It connects the names visible in File Explorer with the records and storage locations behind them. It is essential file-system metadata, not a file that users normally open or maintain themselves.
Indice dei contenuti
Master File Table: Quick Facts
Articolo | Spiegazione |
Abbreviation | MFT |
System filename | $MFT |
Technical category | NTFS metadata file |
Ambito di applicazione | One NTFS volume |
Scopo principale | Describe files, directories, and how their contents are stored |
Record coverage | At least one record for each file or directory, including the table itself |
Data storage | File contents can be resident inside a record or nonresident elsewhere on the volume |
Routine maintenance | No manual deletion or editing is required |
The Master File Table Explained in Plain English
Think of an NTFS volume as a library. Documents, photos, and videos are the books; the Tabella file master is the catalog that identifies them and helps locate them.
The analogy has one important limit. A sufficiently small file can have its contents stored inside its record. The table therefore does more than point to other locations: sometimes it contains the data itself.
A filename such as rapporto.docx is useful to a person, but NTFS also needs to know which directory contains it and how to retrieve its contents. The table supplies the records that describe those relationships.
How the Master File Table Works
The easiest way to understand the mechanism is to follow a file through creation, opening, updating, and deletion.
Creating a File
When an application creates a file, NTFS assigns a base file record and stores its attributes. Those attributes describe different aspects of the file, including its name and data.
If all attributes cannot fit into the base record, NTFS can use additional records. An attribute list identifies where the file’s attributes are located. Consequently, one file does not always correspond to exactly one record in the Tabella file master.
Opening a File: A Simple Example
Suppose an application opens C:\Projects\report.docx. At a simplified level, NTFS follows these relationships:
- Resolve the directory path. Directory indexes identify the entries along the requested path.
- Find the file reference. The entry for
rapporto.docxrefers to its base file record. - Read the file’s attributes. NTFS interprets the record and any associated extension records.
- Retrieve the requested data. The $DATA attribute either contains the contents or describes their storage outside the record.
This illustrates the role of the Tabella file master in file access. It is not a claim that every open operation physically rereads the whole table; Windows can cache file-system information.
Data form | Where the contents are stored | How NTFS retrieves them |
Resident | Inside the file record | Reads the attribute value |
Nonresident | In clusters elsewhere on the volume | Uses the attribute’s mapping information |
A cluster is an allocation unit on the volume. These mappings describe logical storage locations, not the physical arrangement of flash cells inside an SSD. Microsoft’s documentation explains the distinction through resident and nonresident attribute structures.
Updating a File
Saving changes can alter file contents, file size, timestamps, or allocation information. NTFS updates the relevant data and metadata to reflect those changes. The exact changes depend on the operation: renaming a file and appending data affect different attributes.
Il Tabella file master is therefore an active structure used during normal file operations, rather than a catalog created once and left unchanged.
Deleting a File
Once a file is actually deleted from the file system, its records can become available for reuse. Moving a file to the Recycle Bin is not the same as completing this deletion.
The record header includes a sequence number that changes when a record is freed. Together with the record number, it helps distinguish a current file reference from an obsolete one. A reusable record should not be interpreted as a permanent archive of the deleted file.
What Does a Master File Table Record Contain?
Each record starts with a header and contains attributes. The header describes the record; the attributes describe aspects of the file.
Component or information | Scopo |
Record header | Describes record status and information needed to interpret it |
$INFORMAZIONI_STANDARD | Holds basic metadata, including timestamps and file flags |
$ NOME_FILE | Stores a filename and a reference to its parent directory |
$DATA | Represents file contents, either resident or nonresident |
File size and allocation information | Describes the data stream’s logical length and allocated storage |
$ATTRIBUTE_LIST, when required | Locates attributes distributed across multiple records |
Security identifier | Connects the file to its security information |
These are selected components, not an exhaustive list. For a deeper explanation, see the guide to Master File Table records.
File Size Is Different From Allocated Size
File size is the logical length of a data stream. Allocated size describes the storage allocated to it. For an ordinary nonresident, uncompressed file, allocation occurs in whole clusters, so allocated storage may exceed the logical file length.
For example, on a volume with 4,096-byte clusters, an ordinary 5,000-byte nonresident data stream needs two clusters, or 8,192 bytes of allocated storage. This is an illustrative calculation, not a universal rule for resident, compressed, or sparse data.
A Filename Is Different From a Full Path
The $FILE_NAME attribute contains a name and a parent-directory reference. It does not simply store C:\Projects\report.docx as one complete path field.
A parser can reconstruct a path through directory relationships. This explains why a report may show a full path even though that path is not stored as a single attribute in the Tabella file master.
Permissions Use Related Security Metadata
In NTFS 3.x, $STANDARD_INFORMATION includes a security identifier, while the $Secure metadata file stores security descriptors. Each record does not need to contain a separate, complete copy of every permission setting.
Why the Master File Table Matters
Comprendere il Tabella file master helps distinguish a file’s identity from its contents. A filename found in a metadata report does not, by itself, establish that the complete document remains readable.
It also helps interpret technical output. For example, an MFT starting cluster identifies where the table begins on a volume. It does not identify the location of every user file or prove that the table is healthy.
The practical lesson is to read each field for what it actually describes. Names, parent references, data mappings, and timestamps answer different questions; none is a substitute for a separate backup.
Master File Table vs NTFS and FAT
NTFS is the file system; the Master File Table is one of its central structures. The terms describe different levels of the storage system.
Termine | Significato |
NTFS | The file system organizing files and directories on a volume |
MFT | The table of records describing those objects |
$MFT | The NTFS metadata file containing the table |
Record MFT | An individual record within that table |
GRASSO | A File Allocation Table used by FAT-family file systems to track cluster chains |
In FAT32, directory entries hold file information, while the FAT links the clusters allocated to files. NTFS uses file records and attributes, including mappings for nonresident data. The MFT is therefore not simply another name for a FAT.
NTFS has other bookkeeping structures too. The volume’s $Bitmap tracks cluster allocation, while $MFT has its own bitmap for tracking record use. These answer different questions: which storage clusters are allocated, and which records are occupied.
Where Is the Master File Table Located?
Il Tabella file master resides on the NTFS volume it describes. Its special filename is $MFT, represented at the volume root—for example, C:\$MFT for a volume mounted as C:.
That is a logical location, not a fixed physical address shared by every drive. NTFS volume information exposes the starting logical cluster number through MftStartLcn.
The MFT zone is space reserved to accommodate table growth. It is distinct from the allocated records inside $MFT. For more detail about logical paths and cluster locations, read the Master File Table location guide.
How to View Master File Table Information in Windows
On Windows 10 or Windows 11, open an administrator Command Prompt or Terminal and run:
- fsutil fsinfo ntfsinfo C:
Sostituire C: with the appropriate NTFS drive letter. This command queries volume information; it does not repair or rebuild the table.
Depending on the Windows version, the output can include these fields:
Campo | Cosa ti dice |
Bytes Per FileRecord Segment | The record size used on this volume |
Mft Start Lcn | The starting logical cluster number of the table |
Mft Zone Start / End | The boundaries of the reserved growth zone |
For example, a record size of 1,024 bytes describes one record segment. It does not mean every file is 1,024 bytes long or that the entire table occupies that amount of space.
Microsoft documents the query in its fsutil fsinfo command reference. Viewing these summary fields is different from parsing individual records and checking file contents.
Common Misconceptions and Safety
The MFT Is Not a Complete Backup
$MFTMirr duplicates a limited initial portion of the table, not every file record. Neither it nor the Tabella file master provides a separate backup of all user files.
Its Presence Does Not Indicate Malware
$MFT is an expected NTFS metadata file. However, an unrelated downloaded file with “MFT” in its name should not automatically be treated as this system object. Identify the context before drawing conclusions about an unfamiliar filename.
Do Not Delete or Disable It
Manually deleting, overwriting, or editing $MFT can prevent NTFS from interpreting files correctly. It is not a cleanup target or an optional feature that can be switched off.
If a drive becomes inaccessible, protect important data before choosing a repair workflow. CHKDSK repair options modify the file system; they are different from the information query shown above.
What Happens If the Master File Table Is Corrupted?
Un corrotto Tabella file master can prevent NTFS from locating or interpreting files correctly. Files or folders may become inaccessible even when some underlying contents remain on the drive. However, a RAW volume or startup failure alone does not prove that the MFT is damaged.
If important files are affected, prioritize data protection before attempting repairs. Avoid formatting the volume or immediately running chkdsk X: /f, which modifies the file system. Where possible, secure a backup or disk image first. For further guidance, see the RAW drive troubleshooting guide.
When to Use a Related Guide
If the goal is to understand the Tabella file master, no maintenance action is required.
For genuinely deleted files, continue with the Guida al recupero dei file cancellati. For a RAW volume or a related CHKDSK message, use the RAW drive troubleshooting guide.
Detailed repair, table size, disk usage, fragmentation, and mirror analysis remain separate topics. They should be evaluated against the actual symptoms rather than added to a general definition.
Conclusione
Il Tabella file master supplies the records NTFS needs to describe files and retrieve their contents. Its attributes connect names, directory relationships, and data storage. Understanding those connections makes technical reports easier to interpret and explains why metadata, file contents, and backups serve different purposes.
Master File Table FAQs
Is $MFT an Ordinary File With a .mft Extension?
example.mft may belong to an unrelated application. Check its context and role before assuming that it is part of the NTFS Master File Table.Does Each NTFS Volume Have Its Own Table?
Do Folders Have MFT Records Too?
Can Multiple Filenames Refer to the Same File?
What Identifies a File's Entry in the Table?
Is the MFT the Same as the Windows Search Index?
Does a Listed Filename Prove That a File Is Recoverable?
Can a Timestamp Prove When Someone Opened a File?
