As a side note, for extremely small files, the actual file content is written directly the $MFT entry, the size limit is around 700 bytes for 1024 bytes $MFT re

As a side note, for extremely small files, the actual file content is written directly the $MFT entry, the size limit is around 700 bytes for 1024 bytes $MFT records and around 3750 for 4096 bytes $MFT record. Some reference, JFYI: https://www.forensicfocus.com/forums/general/mft-resident-data/ https://www.forensicfocus.com/forums/general/mft-resident-da...