01Location
- <NTFS volume>\$LogFile (MFT entry 2)
02Questions it answers
- Which recent metadata transactions are still present in the journal?
- Which MFT entries were last changed by a given logged operation (via the LSN stored in each entry header)?
- What log position was recorded at the last check-disk run (checkdisk last LSN)?
03Format and versions
| Format | Log File Service pages protected by fix-up values: restart pages (signature 'RSTR', or 'CHKD') and record pages ('RCRD'). Records start with an LFS_RECORD_HEADER holding this LSN, previous LSN, undo-next LSN, client data length, client ID, record type and transaction ID. |
|---|---|
| Applies to | All NTFS volumes; the public libfsntfs description of record contents is still incomplete. |
04Key fields
| Field | What it tells you |
|---|---|
| Restart page header | Signature, checkdisk last LSN, system page size, log page size, restart offset, minor and major format version. |
| LSN / previous LSN / undo-next LSN | Chain values linking log records. |
| RecordType / TransactionId | Record kind (commit, client restart, client update) and grouping identifier. |
| MFT entry header LSN | $LogFile sequence number of the last logged change to that MFT entry. |
05Examination workflow
- Extract $LogFile together with $MFT and $UsnJrnl from the same volume state.
- Validate restart pages and fix-up values before parsing record pages.
- Follow LSN chains and map records to MFT entries using the LSN in each entry header.
- Use the results only in combination with $MFT and $UsnJrnl findings.
06Interpretation pitfalls
- $LogFile exists to restore file system consistency after a failure, not as an audit trail.
- Record payloads are only partly documented in public sources; interpretations should be validated against test data.
- The cited sources document no wall-clock timestamp in the log structures themselves; timing must come from related $MFT or $UsnJrnl records.
08Sources
- New Technologies File System (NTFS) libyal / libfsntfs (J. Metz) · checked 2026-10-14
- NTFS overview Microsoft Learn · checked 2026-10-14
- MFTECmd README Eric Zimmerman (GitHub) · checked 2026-10-14