https://www.logfileparser.com/en/blog Latest from Blog en Sun, 27 Sep 2026 20:44:11 GMT https://www.logfileparser.com/en/blog/logfile-parser-comparison https://www.logfileparser.com/en/blog/logfile-parser-comparison A factual comparison of NTFS $LogFile tools: LogFileParser, NTFS Log Tracker, TZWorks mala, dfir_ntfs, ntfstool, MFTECmd and a browser parser. When to use each. Florian Amette Sun, 27 Sep 2026 00:00:00 GMT https://www.logfileparser.com/en/blog/logfile-limitations https://www.logfileparser.com/en/blog/logfile-limitations NTFS $LogFile retention in practice and its other blind spots: no clock, missing names, metadata only, rewritten by chkdsk or ntfs-3g, parsers that disagree. Florian Amette Thu, 24 Sep 2026 00:00:00 GMT https://www.logfileparser.com/en/blog/logfile-investigation-walkthrough https://www.logfileparser.com/en/blog/logfile-investigation-walkthrough A fictional intrusion on FIN-WKS-07 worked end to end from the NTFS $LogFile: rogue account, toolkit, backdated binary, rclone, a deleted note, and the report. Florian Amette Tue, 22 Sep 2026 00:00:00 GMT https://www.logfileparser.com/en/blog/logfile-restart-area-lsn https://www.logfileparser.com/en/blog/logfile-restart-area-lsn Inside the NTFS $LogFile restart pages: restart area fields, the NTFS client record, checkpoints, and how to turn a log sequence number into a file offset. Florian Amette Sat, 19 Sep 2026 00:00:00 GMT https://www.logfileparser.com/en/blog/logfile-version-1-1-vs-2-0 https://www.logfileparser.com/en/blog/logfile-version-1-1-vs-2-0 NTFS log format 1.1 and 2.0 side by side: tail pages vs 32 fast pages, where the circular area starts, why live captures show 2.0, and what parsers must do. Florian Amette Thu, 17 Sep 2026 00:00:00 GMT https://www.logfileparser.com/en/blog/logfile-deleted-files-evidence https://www.logfileparser.com/en/blog/logfile-deleted-files-evidence What the NTFS $LogFile keeps after a deletion: name, folder, MFT entry, times, sizes, data runs, sometimes content. How to find it and what it cannot prove. Florian Amette Tue, 15 Sep 2026 00:00:00 GMT https://www.logfileparser.com/en/blog/detect-timestomping-logfile https://www.logfileparser.com/en/blog/detect-timestomping-logfile How $LogFile exposes timestomping: $STANDARD_INFORMATION before and after values, $SI vs $FN checks, four practical tells, false positives, and how to confirm. Florian Amette Sat, 12 Sep 2026 00:00:00 GMT https://www.logfileparser.com/en/blog/logfile-redo-undo-operations https://www.logfileparser.com/en/blog/logfile-redo-undo-operations The NTFS log record header byte by byte, the 38 redo/undo opcodes, which ones matter in forensics, and how create, delete, rename and timestamp changes look. Florian Amette Thu, 10 Sep 2026 00:00:00 GMT https://www.logfileparser.com/en/blog/how-to-analyze-ntfs-logfile https://www.logfileparser.com/en/blog/how-to-analyze-ntfs-logfile A practical walkthrough: load $LogFile and $MFT in a browser parser, read the log header, triage flagged events, check raw redo/undo bytes and export results. Florian Amette Tue, 08 Sep 2026 00:00:00 GMT https://www.logfileparser.com/en/blog/acquire-ntfs-logfile https://www.logfileparser.com/en/blog/acquire-ntfs-logfile Copy the locked NTFS $LogFile and its $MFT: KAPE, Velociraptor, FTK Imager, RawCopy, icat and ntfscat commands, plus checks that prove the copy is usable. Florian Amette Sat, 05 Sep 2026 00:00:00 GMT https://www.logfileparser.com/en/blog/logfile-vs-usnjrnl-vs-mft https://www.logfileparser.com/en/blog/logfile-vs-usnjrnl-vs-mft $LogFile, $UsnJrnl:$J and $MFT compared from the transaction log's side: what each records, how far back it goes, what only $LogFile proves, how to join them. Florian Amette Thu, 03 Sep 2026 00:00:00 GMT https://www.logfileparser.com/en/blog/ntfs-logfile-forensics-guide https://www.logfileparser.com/en/blog/ntfs-logfile-forensics-guide What the NTFS $LogFile records, how its pages and redo/undo records work, what it proves in an investigation, how to collect it and where it stops. Florian Amette Tue, 01 Sep 2026 00:00:00 GMT