This document describes classes used for forensic and data recovery of NTFS volumes. The CNTFSVolume class encapsulates an NTFS volume. The CFileRecord class parses file records, which are the most important as NTFS treats almost everything as files. Standard attributes in a file record header include identifiers, sizes, timestamps and references. The CAttrBase class is the base class for attribute classes, with CAttrResident for resident attributes and CAttrNonResident for non-resident attributes. Specific attribute classes like CAttr_StdInfo and CAttr_FileName implement standard attributes. Helper classes include CFileName for file name processing and CIndexEntry and CIndexBlock for index entries.