Glossary
Redo and undo operations
The pair of operations every NTFS $LogFile record carries: redo describes how to apply a metadata change, undo how to reverse it.
Each NTFS log record names two operations and carries bytes for both. The redo operation and data describe how to apply the change again; the undo operation and data describe how to roll it back. After a crash, Windows replays redo for committed transactions and applies undo for the rest.
For forensics, the pair is a before-and-after snapshot. An UpdateResidentValue on $STANDARD_INFORMATION holds the new timestamps in redo and the old ones in undo; a DeleteIndexEntry holds the removed directory entry with the file's name and parent. Undo is usually the inverse of redo (add vs delete index entry, create vs delete attribute); some records have Noop as undo. The opcodes are listed in redo/undo operations explained.