Glossary
$MFT (Master File Table)
The NTFS index where every file and directory has a record. Read it and you have the volume's entire structure, including entries marked deleted.
The $MFT is the heart of an NTFS volume. Every file, directory, and metadata
object gets at least one 1 KiB record, each starting with the FILE signature
and built from a sequence of typed attributes: $STANDARD_INFORMATION for
timestamps, $FILE_NAME for the name and parent reference, $DATA for the
content itself.
Small files live entirely inside their record (resident data). Larger ones store
$DATA as runs that point at clusters elsewhere on the volume. Record 0 is the
$MFT describing itself; the boot sector tells you where it starts.
Deleting a file does not erase its record, it just clears the in-use flag, which is why walking the table recovers deleted entries. The parser walks the $MFT in the browser to build the file tree and extract content.