Exploring filesystem metadata on Windows

- [Host] Window systems usually boot from, and use a disc with the NTFS file system. And when they do, they store their file system metadata in a structure called an MFT, or master file table. This data structure keeps track of the names of files and where their data is stored on the disc. It also keeps track of the basic and extended attributes we can attach to the files. In addition to some more specialized metadata. This data structure allows us to add alternate data streams to files as well. Like other file systems, NTFS stores standard information like file names, and various file modification dates. We can see some of this basic information in the Explorer properties pin. Which we can get to by right clicking a file, and choosing properties. Here's the name, the size and a few dates. We can find a bit more information over on the details tab, including some of its attributes. We'll explore attributes more in just a…