Method and apparatus for detecting a rootkit

A method and apparatus for detecting a rootkit is described. In one embodiment, a method for detecting a rootkit comprises analyzing file system information associated with a plurality of files that form a volume, wherein a first portion of the file system information comprises metadata information for a master file table and a second portion comprises at least one master file table record and identifying an inconsistency within the file system information where the inconsistency indicates a modification to the file system information by a rootkit.