$LogFile (NTFS Transaction Log)

Location

Description

NTFS transaction log recording redo and undo operations for filesystem metadata changes. Provides more granular detail than $UsnJrnl for recent operations including incomplete and rolled-back transactions.

Forensic Value

$LogFile contains detailed redo/undo pairs for every NTFS metadata change in the most recent hours to days, providing finer granularity than the USN journal. It captures partial and failed operations that other artifacts miss, such as an incomplete file copy or a rolled-back rename. For recent activity, $LogFile can recover file creation, deletion, and rename operations with full timestamps even when $UsnJrnl has wrapped.

Tools Required

Collection Commands

kape.exe --tsource C: --tdest C:\output --target NTFS

RawCopy.exe /FileNamePath:C:2 /OutputPath:C:\output /OutputName:$LogFile

Load $LogFile alongside $MFT and $UsnJrnl in NTFS Log Tracker for correlated timeline analysis

Collection Constraints

• •Availability, retention, and field coverage depend on the Windows release, SKU, per-host audit policy, and user activity. Treat absence as inconclusive unless you verified the feature was enabled.

MITRE ATT&CK Techniques

References