| Glossary |
This is a system file that duplicates at least the first four FILE records of the MFT for recovery purposes.
If the cluster size of the volume is less than or equal to four times the mft record size, i.e. usually the cluster size is less than or equal to 4096 bytes, then the first four MFT records are stored in the $MFTMirr.
If the cluster size is greater than four times the mft record size, then the size of $MFTMirr is one cluster and as many MFT records are stored in it as fit inside a cluster.
For example given an MFT record size of 1024 bytes and a cluster size of 8192 bytes the $MFTMirr would be 8192 bytes long and it would contain the first eight FILE records of the MFT.
| Type | Description | Name |
|---|---|---|
| 0x10 | $STANDARD_INFORMATION | |
| 0x30 | $FILE_NAME | $MFTMirr |
| 0x80 | $DATA | [Unnamed] |
A copy of at least the first four FILE records of the $MFT.
| Inode | Filename | Description |
|---|---|---|
| 0 | $MFT | Master File Table - An index of every file |
| 1 | $MFTMirr | A backup copy of the first 4 records of the MFT |
| 2 | $LogFile | Transactional logging file |
| 3 | $Volume | Serial number, creation time, dirty flag |
| 4 | ... | If present, further FILE records from the MFT (see $MFT) |