NTFSInfo is a free, lightweight command-line utility from Microsoft Sysinternals that displays detailed information about NTFS volumes — including cluster size, Master File Table (MFT) location and size, MFT-Zone reservation, and hidden NTFS metadata files such as $Boot, $Bitmap, and $Mft. Designed for IT administrators, storage engineers, and Windows internals enthusiasts performing NTFS diagnostics, filesystem analysis, and volume troubleshooting, NTFSInfo reveals the low-level structure of any NTFS drive in seconds. It is part of the Microsoft Sysinternals suite and is distributed as an MSI installer for easy deployment.

All releases are available on the Releases page. Each release includes SHA-256 checksums for verification.

• NTFS volume summary — cluster size, MFT record size, and volume-level NTFS parameters at a glance
• Master File Table (MFT) analysis — view MFT location on disk (in clusters), total size, and record count
• MFT-Zone reporting — see where the MFT-Zone is located and what percentage of the drive is reserved to prevent MFT fragmentation
• Hidden metadata file listing — enumerate NTFS system files ($Boot, $Bitmap, $Mft, $LogFile, and more) with sizes
• Boot sector mapping — shows how the $Boot metadata file maps to the volume boot sector
• Cluster bitmap inspection — reveals the $Bitmap file that tracks allocated and free clusters
• Single-drive simplicity — pass a drive letter and get a complete NTFS internals dump instantly
• Undocumented FSCTL access — uses a native NTFS File System Control call for accurate volume data
• Command-line automation — script NTFS volume audits across servers for storage health reporting
• Enterprise deployment — silent MSI install via Group Policy, SCCM, or Intune
• No agent required — standalone executable with no background services or dependencies

NTFSInfo uses an undocumented File System Control (FSCTL) call to query NTFS about a volume's internal structure. It prints volume parameters — cluster size, MFT location, MFT-Zone boundaries — and performs the equivalent of dir /ah on the NTFS root directory to list all hidden metadata files and their sizes. The Master File Table (MFT) is itself managed as a regular file on NTFS volumes, and NTFSInfo shows exactly where it lives on disk and how large it has grown.

1. Download NTFSInfo.msi from the latest release
2. Run NTFSInfo.msi or install silently, then open an elevated command prompt
3. Inspect an NTFS volume: ntfsinfo C:
4. Review MFT location, MFT-Zone size, cluster allocation unit, and metadata file listing
5. Compare output across drives to identify fragmentation or misconfiguration issues

msiexec /i NTFSInfo.msi /qn /norestart

ntfsinfo C:
ntfsinfo D:
ntfsinfo E: > D:\reports\ntfs-audit-e.txt

The first two commands dump NTFS internals for the C: and D: volumes. The third redirects output to a log file for documentation or scheduled reporting.

1. Deploy NTFSInfo.msi via Group Policy, SCCM, or Intune to file servers and workstations
2. Run NTFSInfo on each NTFS volume during scheduled maintenance windows
3. Export output to log files and track MFT growth and MFT-Zone utilization over time
4. Identify volumes where the MFT is approaching the MFT-Zone boundary (fragmentation risk)
5. Correlate findings with disk performance issues or backup failures
6. Document volume structure for capacity planning and storage compliance reviews

• MFT health monitoring — track Master File Table size and location to prevent performance degradation from MFT fragmentation
• NTFS internals research — explore how NTFS stores metadata as hidden system files in the volume root directory
• Storage performance tuning — verify cluster size and MFT-Zone configuration on high-I/O file servers
• Disk forensics — document NTFS volume structure during evidence collection and analysis
• Server baseline documentation — capture NTFS parameters as part of infrastructure inventory and change management
• Troubleshooting slow volumes — identify oversized MFT or exhausted MFT-Zone as a root cause of disk latency
• Pre-clone / P2V validation — record source volume NTFS layout before physical-to-virtual migration
• Helpdesk diagnostics — quickly answer questions about NTFS formatting, cluster size, and filesystem structure

If you are looking for similar NTFS analysis and filesystem inspection tools, consider these alternatives:

• fsutil fsinfo ntfsinfo — built-in Windows command showing basic NTFS volume data (less detailed than NTFSInfo)
• fsutil fsinfo statistics — native Windows utility for NTFS filesystem statistics and usage counters
• chkdsk — Windows disk checking tool for filesystem integrity (does not expose MFT internals)
• PowerShell Get-Volume — cmdlet for volume size, health, and filesystem type (no MFT details)
• WinObj / Handle — other Sysinternals tools for object and handle inspection (different scope)
• Commercial storage analyzers — enterprise platforms like TreeSize, SpaceSniffer, or DiskView for space usage visualization
• debugview / disk editors — low-level hex editors for raw boot sector and MFT record inspection

Download NTFSInfo.msi directly from the latest release or visit the Releases page for all versions.

NTFSInfo displays cluster size, MFT record size, MFT location and size, MFT-Zone boundaries, and a listing of hidden NTFS metadata files ($Boot, $Bitmap, $Mft, $LogFile, etc.) with their sizes.

Open an elevated command prompt and run ntfsinfo C: replacing C: with the drive letter of the NTFS volume you want to inspect.

The MFT-Zone is a reserved region of the disk around the Master File Table. NTFS keeps this space free to prevent the MFT from becoming fragmented as it grows. NTFSInfo shows where the MFT-Zone starts and what percentage of the volume is reserved.

No. NTFSInfo only works on NTFS-formatted volumes. Running it against FAT, exFAT, or ReFS drives will produce an error.

Yes. NTFSInfo uses a privileged FSCTL call to query NTFS volume internals and must be run from an elevated command prompt.

Run msiexec /i NTFSInfo.msi /qn /norestart from an elevated command prompt or deploy the MSI package through Group Policy, SCCM, or Intune.

Yes. NTFSInfo lists all NTFS metadata files in the volume root directory — the same files visible with dir /ah but with sizes included. These include $Boot (boot sector), $Bitmap (cluster allocation map), and $Mft (Master File Table).

Yes. NTFSInfo is distributed free of charge as part of the Microsoft Sysinternals Suite under the Sysinternals License.

NTFSInfo is the go-to tool for inspecting NTFS volume internals on Windows. Whether you are monitoring MFT health on a file server, documenting volume structure before a migration, or learning how NTFS manages its metadata as hidden system files, NTFSInfo provides instant, detailed output with a single command. Its focus on MFT location, MFT-Zone reservation, cluster parameters, and metadata file listing makes it an essential utility for Windows administrators, storage engineers, and filesystem researchers.

⬇ Download NTFSInfo.msi