Q:

How can I view the NTFS $MFT using correct field names?

I am trying to view an NTFS master file table. Each tool I have used so far extracts all of the entries, but puts non standard headers such as STANDARD_INFORMATION_ON instead of say $STANDARD_INFORMATION.
I have tried MFT2CSV, ntfswalk64, and MFT_Parser, but I would like a tool that gives me the MFT in a rawer format, so I can see the entries as they are suppose to be, even if I can't read the timestamps without decoding.
Does anyone know a more accurate and rawer tool?

A:

Try this PDF: NTFS Forensics: A Programmers View of Raw Filesystem Data Extraction by Jason Medeiros, 
Grayscale Research 2008
It should answer your questions.
Also, you can read your image with a Hex editor... Well, good luck with that.

A:

I wrote a tool that parses $MFT records, and the entire $MFT file. If you're able to read and write Python, it'd be relatively easy to dump out whatever artifacts you want in whatever form you want them in. The code is here:
https://github.com/dkovar/analyzeMFT

