NTFS Transaction Log ($LogFile)
| Format | NTFS Transaction Log ($LogFile) |
|---|---|
| Short name | $LogFile |
| Category | log |
| Platforms | Windows |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
The NTFS metadata journal: restart pages ('RSTR') followed by log record pages ('RCRD') describing redo and undo operations on MFT entries, indexes and bitmaps. Covers the most recent minutes to hours of file system activity, including creations, renames and deletions.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 52 53 54 52 | RSTR | Restart page signature 'RSTR' |
| offset unknown | 52 43 52 44 | RCRD | Log record page signature 'RCRD' (pages after the restart area) |
Known extensions
None recorded
References
- NTFS $LogFile structures — fs/ntfs3/fslog.c (Linux kernel source) https://github.com/torvalds/linux/blob/master/fs/ntfs3/fslog.c
- Finding Forensic Information on Creating a Folder in $LogFile of NTFS (Cho, Rogers — ICDF2C 2011) https://doi.org/10.1007/978-3-642-35515-8_18
Cite this entry
Crush Format Reference, “NTFS Transaction Log ($LogFile)”. https://kalink0.github.io/crush-forensics/formats/logfile/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction