Glossary
Restart area
The structure in the $LogFile restart pages that tells NTFS where recovery starts: current LSN, log size, sequence-number bits and the NTFS client record.
The restart area lives in each of the two RSTR restart pages at the start of $LogFile. It records the current LSN, the log file size, the number of bits used for the LSN sequence number, flags, the offset where records start in each page, and an array of client records.
NTFS is normally the only client. Its client record points to the latest checkpoint (a log record of type 2), which lists where the open attribute table, attribute names, dirty page table and transaction table were dumped. Recovery starts from there.
The two restart pages are not always in sync; a parser keeps the one with the higher current LSN. A page signed CHKD means chkdsk worked on the log. See restart area and LSNs explained.