Skip to content
$LogFileparser

Series

Investigating with the $LogFile

6 posts in this series. Read them in order or jump to any one.

  1. How to Acquire the NTFS $LogFile (Live and Dead Box)

    Copy the locked NTFS $LogFile and its $MFT: KAPE, Velociraptor, FTK Imager, RawCopy, icat and ntfscat commands, plus checks that prove the copy is usable.

  2. How to Analyze an NTFS $LogFile, Step by Step

    A practical walkthrough: load $LogFile and $MFT in a browser parser, read the log header, triage flagged events, check raw redo/undo bytes and export results.

  3. Detecting Timestomping with the NTFS $LogFile

    How $LogFile exposes timestomping: $STANDARD_INFORMATION before and after values, $SI vs $FN checks, four practical tells, false positives, and how to confirm.

  4. Recovering Deleted-File Evidence from the $LogFile

    What the NTFS $LogFile keeps after a deletion: name, folder, MFT entry, times, sizes, data runs, sometimes content. How to find it and what it cannot prove.

  5. A $LogFile Investigation Walkthrough (Fictional Case)

    A fictional intrusion on FIN-WKS-07 worked end to end from the NTFS $LogFile: rogue account, toolkit, backdated binary, rclone, a deleted note, and the report.

  6. $LogFile Parsers Compared: LogFileParser, NTFS Log Tracker

    A factual comparison of NTFS $LogFile tools: LogFileParser, NTFS Log Tracker, TZWorks mala, dfir_ntfs, ntfstool, MFTECmd and a browser parser. When to use each.

All posts in this series