How Far Back Does the $LogFile Go? Limits and Pitfalls
NTFS $LogFile retention in practice and its other blind spots: no clock, missing names, metadata only, rewritten by chkdsk or ntfs-3g, parsers that disagree.
Posts tagged: #usnjrnl
$LogFile vs $UsnJrnl vs $MFT: Which NTFS Artifact When
$LogFile, $UsnJrnl:$J and $MFT compared from the transaction log's side: what each records, how far back it goes, what only $LogFile proves, how to join them.