$LogFile of NTFS: A blueprint of activities

Authors:

1 December 2014

conference paper
Published by Institute of Electrical and Electronics Engineers (IEEE)

p. 305-310
DOI:10.1109/inmic.2014.7097356

Abstract

Every successful action performed in NTFS leads to update of $MFT. However, there is a chain or set of chains of transactions behind every single activity of NTFS. However, $MFT updation only shows the end product of action and corresponding chain or set of chains of transactions are not documented by it. $Logfile is the file which logs all said transactions. $MFT is a well researched area but $LogFile is relatively a less explored area. $LogFile was created by Microsoft for system recovery. However, it can also be used to get the blueprints of activities of NTFS as it logs all the transactions of NTFS. This paper deals with analysis of $LogFile used in Windows 7, its layout /structure, type of records and their decoding, explanation of information contained in these records and the techniques of reading it to extract blueprints of activities of NTFS.

Keywords

This publication has 1 reference indexed in Scilit:

Forensic Computing
2007