$LogFile Restart Area and LSNs Explained
Inside the NTFS $LogFile restart pages: restart area fields, the NTFS client record, checkpoints, and how to turn a log sequence number into a file offset.
Posts tagged: #file-format
$LogFile Format 1.1 vs 2.0: What Changed in Windows 8
NTFS log format 1.1 and 2.0 side by side: tail pages vs 32 fast pages, where the circular area starts, why live captures show 2.0, and what parsers must do.
NTFS $LogFile Redo/Undo Operations Explained
The NTFS log record header byte by byte, the 38 redo/undo opcodes, which ones matter in forensics, and how create, delete, rename and timestamp changes look.
NTFS $LogFile Forensics: The Complete Guide
What the NTFS $LogFile records, how its pages and redo/undo records work, what it proves in an investigation, how to collect it and where it stops.