Skip to content

Glossary

Update sequence array (fix-ups)

The NTFS torn-write protection in FILE records, index buffers and $LogFile pages: the last two bytes of each sector are swapped for a check value.

An update sequence array (USA), also called fix-ups, protects multi-sector NTFS structures against torn writes. Before writing, NTFS copies the last two bytes of each 512-byte sector into an array in the header and replaces them with an update sequence number. When reading, a parser checks that every sector ends with that number and puts the original bytes back.

$LogFile restart pages (RSTR) and record pages (RCRD) use it, just like FILE records and INDX buffers. A mismatch means the page was only partly written or the copy is damaged. A careful parser counts such pages, keeps their records, and warns that they may hold stale bytes, as described in how to analyze an NTFS $LogFile.