$LogFile Parsers Compared: LogFileParser, NTFS Log Tracker
A factual comparison of NTFS $LogFile tools: LogFileParser, NTFS Log Tracker, TZWorks mala, dfir_ntfs, ntfstool, MFTECmd and a browser parser. When to use each.
Blog
Guides to NTFS $LogFile forensics: format internals, acquisition, timestomping and deleted-file evidence, investigation walkthroughs and tool comparisons.
How Far Back Does the $LogFile Go? Limits and Pitfalls
NTFS $LogFile retention in practice and its other blind spots: no clock, missing names, metadata only, rewritten by chkdsk or ntfs-3g, parsers that disagree.
A $LogFile Investigation Walkthrough (Fictional Case)
A fictional intrusion on FIN-WKS-07 worked end to end from the NTFS $LogFile: rogue account, toolkit, backdated binary, rclone, a deleted note, and the report.
$LogFile Restart Area and LSNs Explained
Inside the NTFS $LogFile restart pages: restart area fields, the NTFS client record, checkpoints, and how to turn a log sequence number into a file offset.
$LogFile Format 1.1 vs 2.0: What Changed in Windows 8
NTFS log format 1.1 and 2.0 side by side: tail pages vs 32 fast pages, where the circular area starts, why live captures show 2.0, and what parsers must do.
Recovering Deleted-File Evidence from the $LogFile
What the NTFS $LogFile keeps after a deletion: name, folder, MFT entry, times, sizes, data runs, sometimes content. How to find it and what it cannot prove.
Detecting Timestomping with the NTFS $LogFile
How $LogFile exposes timestomping: $STANDARD_INFORMATION before and after values, $SI vs $FN checks, four practical tells, false positives, and how to confirm.
NTFS $LogFile Redo/Undo Operations Explained
The NTFS log record header byte by byte, the 38 redo/undo opcodes, which ones matter in forensics, and how create, delete, rename and timestamp changes look.
How to Analyze an NTFS $LogFile, Step by Step
A practical walkthrough: load $LogFile and $MFT in a browser parser, read the log header, triage flagged events, check raw redo/undo bytes and export results.