Logpresso Forensic

Download 0
Last updated Oct 11, 2026

NTFS file entry

Master file table entries

# Field Type Display name Description
1 time DATE Time
2 file_path STRING File path
3 file_name STRING File name
4 file_size LONG File size
5 alloc_size LONG Alloc size
6 in_use BOOL In use
7 is_dir BOOL Is dir
8 si_ctime DATE SI ctime
9 si_mtime DATE SI mtime
10 si_atime DATE SI atime
11 si_mft_mtime DATE SI MFT mtime
12 url STRING URL
13 referer STRING Referer
14 no LONG No
15 fn_ctime DATE FN ctime
16 lsn LONG LSN
17 fn_mtime DATE FN mtime
18 link_count INT Link count
19 fn_atime DATE FN atime
20 fn_mft_mtime DATE FN MFT mtime
21 seq INT Seq
22 file_ref LONG File ref
23 parent_no LONG Parent no
24 parent_file_ref LONG Parent file ref
25 zone_id INT Zone ID
26 zone_name STRING Zone name
27 is_readonly BOOL Is readonly
28 is_hidden BOOL Is hidden
29 is_system BOOL Is system
30 is_archive BOOL Is archive
31 is_device BOOL Is device
32 is_normal BOOL Is normal
33 is_temp BOOL Is temp
34 is_sparse BOOL Is sparse
35 is_reparse BOOL Is reparse
36 is_compressed BOOL Is compressed
37 is_offline BOOL Is offline
38 is_indexed BOOL Is indexed
39 is_encrypted BOOL Is encrypted