Skip to content
$LogFileparser

Series

NTFS $LogFile fundamentals

6 posts in this series. Read them in order or jump to any one.

  1. NTFS $LogFile Forensics: The Complete Guide

    What the NTFS $LogFile records, how its pages and redo/undo records work, what it proves in an investigation, how to collect it and where it stops.

  2. $LogFile vs $UsnJrnl vs $MFT: Which NTFS Artifact When

    $LogFile, $UsnJrnl:$J and $MFT compared from the transaction log's side: what each records, how far back it goes, what only $LogFile proves, how to join them.

  3. $LogFile Restart Area and LSNs Explained

    Inside the NTFS $LogFile restart pages: restart area fields, the NTFS client record, checkpoints, and how to turn a log sequence number into a file offset.

  4. NTFS $LogFile Redo/Undo Operations Explained

    The NTFS log record header byte by byte, the 38 redo/undo opcodes, which ones matter in forensics, and how create, delete, rename and timestamp changes look.

  5. $LogFile Format 1.1 vs 2.0: What Changed in Windows 8

    NTFS log format 1.1 and 2.0 side by side: tail pages vs 32 fast pages, where the circular area starts, why live captures show 2.0, and what parsers must do.

  6. How Far Back Does the $LogFile Go? Limits and Pitfalls

    NTFS $LogFile retention in practice and its other blind spots: no clock, missing names, metadata only, rewritten by chkdsk or ntfs-3g, parsers that disagree.

All posts in this series