$LogFile Parsers Compared: LogFileParser, NTFS Log Tracker

TL;DR. For casework, run LogFileParser (the most detailed open-source decoder, many CSVs plus SQLite) and cross-check with NTFS Log Tracker (events from $LogFile and $UsnJrnl together, carving, LFS 2.0, timestamp-manipulation patterns). Use dfir_ntfs if you script in Python, TZWorks mala if you need a supported commercial CLI on several OSes. Use the in-browser $LogFile parser for fast, no-install, no-upload triage with raw records next to events — and confirm what matters with one of the others, since it is validated on synthetic data only. MFTECmd does not parse $LogFile yet.

No $LogFile tool is authoritative. The format was never published by Microsoft; every parser encodes someone's reverse engineering, and they disagree at the edges. The practical question is which two to run.

The tools at a glance

Facts below come from each project's own page or repository, checked in September 2026.

LogFileParser

The reference open-source decoder. Its readme lists the redo operations it decodes with meaningful output (from InitializeFileRecordSegment to CompensationLogRecord) and nearly every attribute type. Highlights:

• Depth. Separate CSVs for index entries, data runs, security descriptors, open attribute tables, transaction tables, $UsnJrnl records found inside the log, and more; an SQLite database joins them.
• Slack recovery. It recovers transactions from the unused tail of RCRD pages — records left over from before the log was recycled — with an option to rebuild damaged headers.
• Data-run reconstruction. For deleted non-resident files, it rebuilds cluster runs from InitializeFileRecordSegment, CreateAttribute, UpdateMappingPairs and SetNewAttributeSizes, and documents recovering a fragmented file whose FILE record was overwritten.
• Dummy $MFT. Rebuilt from FILE record images in the log.

Caveats, from its own documentation: output is "extremely detailed and very low level", some features have known Unicode limitations, and it is Windows-only. The readme does not discuss LFS 2.0 fast pages explicitly; if you work on Windows 8+ live captures, compare its results with a tool that does.

NTFS Log Tracker

Junghoon Oh's tool focuses on events rather than raw structures, and on combining sources. Version 1.9 (June 2025) per the author's page:

• parses $LogFile and $UsnJrnl:$J, and uses the $MFT for full paths;
• supports the Windows 10 log format (LFS 2.0);
• carves journal records from unallocated space, slack, memory dumps and VSS copies (disabled by default in 1.9);
• detects patterns of timestamp manipulation, system time changes, and some suspicious behaviours;
• exports SQLite and CSV.

It is the natural second opinion for timestomping and deletion findings, and the only one here that ties $LogFile and USN events together out of the box.

TZWorks mala

"$MFT and $LogFile Analysis": a commercial command-line tool that pairs the log with the $MFT for context and produces a chronological list of transactions. Builds exist for Windows, Linux and macOS. Choose it if your organisation needs vendor support and scripted cross-platform processing.

dfir_ntfs

Maxim Suhanov — author of the "How the $LogFile works?" write-up — maintains this Python 3 library. It parses $LogFile alongside $MFT and $UsnJrnl:$J, works directly on images and shadow copies, and uses open attribute table dumps and attribute name dumps when resolving targets. Best for building your own pipeline or checking a structure programmatically.

ntfstool and MFTECmd

ntfstool reads disks and volumes directly and can dump $LogFile in CSV, JSON or raw form — useful for collection plus a first look. MFTECmd, the standard for $MFT and $J, recognises a $LogFile by its RSTR signature but, in its current source, stops with "$LogFile not supported yet". Do not assume your MFTECmd run covered the log.

The in-browser parser (this site)

What it is designed for:

• No install, no upload. Rust compiled to WebAssembly in a Web Worker; nothing leaves the machine. Useful on a locked-down analysis laptop or for data you may not send anywhere.
• Events and records side by side. Creations, deletions, renames/moves, $SI changes and resident data writes, each linked to the raw records with redo/undo hex.
• Both log versions, with tail/fast pages merged when newer (1.1 vs 2.0).
• Paths from the $MFT, streamed in chunks so multi-GB MFTs work; triage ZIPs from KAPE or Velociraptor accepted as-is.
• Explained flags for timestomping hints (method).

What it does not do (yet): validation on real Windows logs — only synthetic ones so far; transaction-based grouping; slack recovery; data-run reconstruction; USN correlation; SQLite output; automation. It is a triage and teaching tool that shows its work, not a replacement for the tools above.

Which two to run

When they disagree, compare by LSN: every tool exposes it, and it identifies a record unambiguously. Look at the redo/undo bytes yourself — redo/undo operations explained covers what to expect.

Frequently asked questions

What is the best tool to parse the NTFS $LogFile?

There is no single best one. LogFileParser is the most detailed open-source decoder; NTFS Log Tracker adds $UsnJrnl correlation, carving and timestamp-manipulation patterns; dfir_ntfs suits Python workflows; TZWorks mala is a supported commercial option; a browser parser suits quick, no-install triage. Use two and compare by LSN.

Does MFTECmd parse the $LogFile?

Not at the time of writing. MFTECmd recognises a $LogFile by its signature, but its source code stops with a message that $LogFile is not supported yet. Use it for $MFT and $J, and a dedicated tool for $LogFile.

Related articles

• How to analyze an NTFS $LogFile, step by step
• How far back does the $LogFile go?
• NTFS $LogFile forensics: the complete guide