how does an imager know what the $MFT looks like?

[mindfulness]

Just curious, when you use an imager like the deepspar and tell it to scan the $MFT how does it identify those sectors? I am not sure if this is a dumb question, but I will ask anyways.

[HaQue]

because it is a known structure
basically it has smarts to analyse bytes and compare to the known structure

[lcoughey]

Read up on how the news file system works.

[HaQue]

news or ntfs?

[mindfulness]

If you tell the imager to scan the $MFT, does it start at the beginning of the drive and work through it one sector at a time checking to see if the sector contains $MFT data, if so then images it? That thought must be flawed, if it has to read every sector it may as well just image the whole drive. Does that mean it just partially reads the sector, enough of it to determine if it is part of the $MFT, then if so it will image the whole sector.