Glossary
MFT entry and sequence number
The pair that identifies an NTFS file: the record number in the Master File Table and a sequence number incremented each time the record is reused.
NTFS identifies files by a 64-bit file reference: a 48-bit MFT entry (record) number and a 16-bit sequence number. The entry number is the file's position in the $MFT; the sequence number is incremented when the entry is freed and later reused for another file. Together they distinguish a deleted file from the file that now occupies its entry.
$LogFile records usually point at an MFT entry rather than a name, so resolving paths needs the $MFT of the same volume. Directory index entries and $FILE_NAME attributes carry full references, including the parent's. An $MFT collected later than the log can name the wrong file when entries were reused — compare sequence numbers. See how to analyze an NTFS $LogFile.