NTFS $LogFile

Location & availability

The $LogFile metadata file at the root of an NTFS volume

Requires raw filesystem acquisition and a compatible parser. The circular log can overwrite earlier transactions quickly.

Fields to examine

• Log sequence numbers and operation/transaction context.
• Referenced file records and parser-supported redo/undo information.
• Metadata changes that can be linked to a specific volume and file identity.

What it can establish

• Support particular filesystem metadata operations in retained transaction records.

What it cannot prove

• Assign a trustworthy wall-clock time to every operation solely from an LSN.
• Prove a program ran or a human deliberately deleted evidence.

Use it in a screenshare

1. Preserve $LogFile together with $MFT and relevant journal data from the same volume.
2. Parse a copy using a tool that supports the format. Keep raw record references beside the interpretation.
3. Reconstruct a narrow operation sequence and anchor it to independently timed records. Explain where records are incomplete or only suggestive.

Worked example

A parsed transaction sequence is consistent with a rename seen in USN. It adds filesystem context. Without an independent timestamp anchor, report relative ordering rather than inventing an exact time for every transaction.

Cross-check the finding

• USN Journal / $UsnJrnl →Support recorded file/directory changes and a sequence within retained journal coverage.
• $MFT →Support the presence and recorded metadata of a particular file record.
• Directory indexes / $I30 →Support a directory/name association represented by a valid entry.

Sources

• LogFileParser — parser implementation ↗
• Microsoft — Master File Table ↗