How to Acquire the NTFS $LogFile (Live and Dead Box)
Copy the locked NTFS $LogFile and its $MFT: KAPE, Velociraptor, FTK Imager, RawCopy, icat and ntfscat commands, plus checks that prove the copy is usable.
Blog
$LogFile vs $UsnJrnl vs $MFT: Which NTFS Artifact When
$LogFile, $UsnJrnl:$J and $MFT compared from the transaction log's side: what each records, how far back it goes, what only $LogFile proves, how to join them.
NTFS $LogFile Forensics: The Complete Guide
What the NTFS $LogFile records, how its pages and redo/undo records work, what it proves in an investigation, how to collect it and where it stops.