Glossary
Tail pages and fast pages
The special area of the NTFS $LogFile after the restart pages: two tail pages in log format 1.1, 32 fast pages in format 2.0 (Windows 8 and later).
Between the restart pages and the circular record area, $LogFile keeps a small special area that protects the page currently being written. Log format 1.1 uses two tail pages, copies of the current record page, and starts the circular area at 0x4000 with 4 KiB pages. Format 2.0, used by Windows 8 and later while the volume is mounted, uses 32 fast pages written in turn and starts the circular area at 0x22000.
On a live capture the newest records may exist only in this area. A parser must find which circular page each tail or fast page stands for and use the newer copy. Details in $LogFile format 1.1 vs 2.0.