Back
MFT Reader
Forensic Engine Kotlin / Native
NTFS Master File Table (MFT) low-level direct disk scanner • Component of SRV Cleaner
Overview (English)
MFT Reader is a high-speed forensic disk analyzer written in Kotlin with low-level native interop. Built as a core subsystem of SRV Cleaner, it directly reads raw NTFS Master File Table (MFT) structures straight from disk sectors, allowing security researchers to detect deleted, hidden, or locked file artifacts by keyword signatures without relying on high-level Windows Win32 API calls.
Key Capabilities
✓ Raw Disk Sector Access
Bypasses standard OS filesystem APIs by directly parsing raw disk volume streams.
✓ Forensic Keyword Search
Matches pattern signatures across resident and non-resident MFT records in milliseconds.
✓ Privilege Verification
Automated UAC elevation check verifying SeManageVolumePrivilege before raw disk access.
✓ Deleted Record Recovery
Analyzes unallocated record flags to locate remnant filenames and timestamp traces.