A typical NTFS filesystem contains hundreds of thousands of files. Each file has its own $MFT entry, and all $MFT entries are given a sequential address starting from zero, zero being the $MFT entry itself. Each MFT entry is addressed using an 6 byte number, additionally the preceding 2 bytes contains the MFT Sequence number,…
Article Link: https://www.andreafortuna.org/dfir/using-mft-anomalies-to-spot-suspicious-files-in-forensic-analysis/