During a forensic investigation on a Windows workstation, an analyst suspects a malicious file was deleted before the machine was seized. The analyst needs to recover metadata about the deleted file, including its original name, size, and timestamps, even though the file's data clusters may have been reused. Which NTFS operating system component should the analyst examine to find this residual metadata?