Glossary

Plain-language definitions of the NTFS and $LogFile terms used across the tool and the blog.

Open attribute table: The NTFS log's table of attributes currently open for logging; records refer to their target attribute by an index into it.
Resident attribute: An NTFS attribute whose value is stored inside the FILE record itself rather than in separate clusters; small files can have resident data.
MFT entry and sequence number: The pair that identifies an NTFS file: the record number in the Master File Table and a sequence number incremented each time the record is reused.
USN journal ($UsnJrnl:$J): The NTFS change journal: one dated record per file change with reason flags, file reference and name, usually covering days to weeks.
Timestomping: Deliberately changing a file's timestamps to hide when it was created or modified, typically by rewriting NTFS $STANDARD_INFORMATION times.
$FILE_NAME ($FN): The NTFS attribute (type 0x30) holding a file's name, parent folder reference, sizes and a second set of four timestamps maintained by the file system.
$STANDARD_INFORMATION ($SI): The NTFS attribute (type 0x10) holding a file's main timestamps, flags and security and USN fields; the set that timestomping tools usually rewrite.
Tail pages and fast pages: The special area of the NTFS $LogFile after the restart pages: two tail pages in log format 1.1, 32 fast pages in format 2.0 (Windows 8 and later).
Update sequence array (fix-ups): The NTFS torn-write protection in FILE records, index buffers and $LogFile pages: the last two bytes of each sector are swapped for a check value.
Redo and undo operations: The pair of operations every NTFS $LogFile record carries: redo describes how to apply a metadata change, undo how to reverse it.
Restart area: The structure in the $LogFile restart pages that tells NTFS where recovery starts: current LSN, log size, sequence-number bits and the NTFS client record.
Log sequence number (LSN): The 64-bit, always-increasing identifier of every NTFS $LogFile record, encoding a wrap counter and the record's offset in the file.
$LogFile (NTFS transaction log): The NTFS metadata transaction journal, MFT entry 2 at the root of every NTFS volume, holding redo and undo records for recent metadata changes.