Glossary
$LogFile (NTFS transaction log)
The NTFS metadata transaction journal, MFT entry 2 at the root of every NTFS volume, holding redo and undo records for recent metadata changes.
$LogFile is the journal NTFS uses to keep its own metadata consistent. It is file record 2 in the Master File Table and sits at the root of every NTFS volume. Before NTFS changes a FILE record, a directory index or a bitmap, it writes a log record describing the change as a redo and an undo operation. After a crash, Windows replays or rolls back those records.
The file is circular, usually about 64 MiB on current Windows volumes, so it covers minutes to hours of activity. It starts with two restart pages, followed by tail or fast pages and the circular area of record pages.
For investigators it shows recent file creations, deletions, renames and timestamp changes with before and after values. See the complete $LogFile guide.