$Mft is the NTFS "Master File Table" – it's the file which holds all information about what files you have and where they are physically.

You seem to have about 8 million files, so assuming a ~1 kB metadata entry per file, an 8 GB $Mft is entirely reasonable.

Remember to check our discord where you can get faster responses! https://discord.gg/NB3BzPNQyW I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

If you search around online you'll find a few speculated reasons, such as these: The table does not, cannot, respect effective security permissions for files and folders. The table does not include virtual files or such that do not physically exist on the drive but still logically has a presence on it. Non-NTFS filesystems does not have that table. There's probably other reasons involving user's expectance for the search to be able to search the contents of files as well and not merely going by their filenames. I don't think Microsoft have ever given an official reason as to why they do not use it, but just the security implications alone is quite the major barrier. Windows is designed as a multi-user operating system and allowing the built-in search functionality to bypass the user's permissions and allow them to "peek" for files beyond their user context would be quite the security concern.

Accessing a disk's cluster BITMAP can be read via the FSCTL_GET_VOLUME_BITMAP API call. However, it won't tell what files are at each cluster. You need either parse the MFT (faster) or recursively call FSCTL_GET_RETRIEVAL_POINTERS on each file (slow).

I don't believe there is a native way to do it, but I would use testdisk if I had to. Something to note is a modern window install will use GPT rather then MFT, sit wont exist in that case.