$LogFile (NTFS Transaction Journal)
Also called NTFS log file, LogFile journal, transaction log NTFS.
- PLATFORM
- Windows
- CATEGORY
- Filesystem Metadata and Timestamps
- INDEX
- 26 of 36
- PROVES
- 4 findings
- CANNOT PROVE
- 5 limits
- QUESTIONS
- 3 answered
The NTFS transaction journal, recording individual metadata operations in order so they can be rolled back — the most granular record of filesystem activity, covering the shortest window.
Where it lives
\$LogFile in the root of every NTFS volume
Name the location in the preservation request rather than describing the artifact in general terms. A request that asks for the record by its path is one the responding party can act on and one a court can enforce; a request for “all forensic evidence of $logfile (ntfs transaction journal)” is neither.
What it records
NTFS writes redo and undo information for each metadata operation before committing it, so that an interrupted change can be completed or reversed. The result is an ordered record of file creations, deletions, renames, attribute changes and directory updates at a level of detail no other artifact matches, including values before and after a change. The journal is a fixed-size circular buffer, so it overwrites itself continuously.
What it proves — and what it cannot
These two panels carry equal weight, deliberately. The right-hand column is not a disclaimer: it is the specific, mechanical reason an inference fails, and it is the column opposing counsel will read back to a witness on cross-examination.
What it proves
FINDINGS THIS ARTIFACT WILL SUPPORT ON ITS OWN TERMS.
- That specific metadata operations occurred, in order, with the before and after state of the affected records
- Sequences that reveal what a bulk operation actually did — the creation, rename and deletion of a staging directory, for instance
- Evidence of timestamp manipulation, because the journal records the write that changed a timestamp value
- That a file existed briefly and was removed, where nothing else retained a trace
What it cannot prove
INFERENCES IT WILL NOT CARRY, HOWEVER STRONGLY IT POINTS.
- Anything outside a very short window. The journal is a fixed-size circular buffer, so on an active volume coverage is measured in hours, and on a busy server in minutes
- Which user or process performed an operation. Journal records describe filesystem changes and carry no account or process identity
- File content. Only metadata operations are journalled; the data written to a file is not
- Intent behind a sequence. A rapid series of creations and deletions is consistent with staging and equally consistent with an application's ordinary temporary-file behaviour
- That an absent operation did not occur. Given the coverage, absence in the journal is almost never informative
How the finding is attacked
An opinion built on this artifact meets these arguments. Each of them is answerable, and each of them is answered before the report is served rather than at a deposition.
- Establishing the journal's earliest surviving record and showing it does not reach the events in dispute
- Pointing out that no user attribution exists in the record
- Arguing that the operation sequence is indistinguishable from routine application behaviour
- Questioning parser interpretation, since the format is undocumented by the vendor and tool output varies
What survives, and for how long
The journal is circular and fixed in size, so it holds only the most recent activity — typically hours on an active workstation. It is the artifact most likely to be destroyed simply by leaving a machine running, which is why powering a system down or preserving it immediately is worth more than any subsequent analysis technique.
More matters are decided by what an artifact never kept than by what it says, which makes preservation timing the most consequential decision in the matter — and it is usually made months before anyone examines anything. The evidence preservation deadline calculator works from the date you first anticipated litigation.
Questions counsel ask
How far back does $LogFile go?
Hours on an active workstation, and minutes on a busy server. The NTFS transaction journal is a fixed-size circular buffer that overwrites itself continuously, so it holds the most recent filesystem activity and nothing else. It is the most detailed record available and the shortest-lived, which means its value depends entirely on how quickly the system was preserved.
What does $LogFile show that $UsnJrnl does not?
It records the before and after state of the affected metadata, not merely that a change of a given type occurred. Where the change journal records that a file was created, renamed or deleted, the transaction journal can show the prior values that the operation overwrote — including timestamp values, which is how manipulation is sometimes detected. It covers a far shorter period in exchange.
Does $LogFile record who deleted a file?
No. The transaction journal records filesystem operations so that they can be rolled back; it carries no account identity and no process identity. It can establish that a file at a path was deleted and in what order relative to other operations. Attributing the deletion to a user requires another artifact, such as the Recycle Bin's per-SID folders or an event log.
Terms used on this page
Every term below is defined in the forensic glossary — what it is, why a case turns on it, and what happens when it is mishandled.
Related artifacts
No artifact carries a matter on its own. These are the records that corroborate, contradict, or supply the timeline this one cannot.
$UsnJrnl (USN Change Journal)
A per-volume journal recording every change to every file — creation, deletion, rename, data overwrite — with a timestamp, a filename and a reason code for each entry.
$MFT (Master File Table)
The NTFS index of every file and directory on a volume, holding two independent sets of four timestamps per file plus, for small files, the file's entire content.
Recycle Bin ($I and $R Files)
Deleted files moved to the Recycle Bin are stored as a renamed copy of the content plus a metadata file recording the original path, original size and the deletion time.
Volume Shadow Copies
Point-in-time block-level snapshots of a volume, often holding an earlier version of a file that has since been altered or deleted — sometimes the only copy of a document as it originally stood.
Whether the $logfile (ntfs transaction journal)evidence in your matter supports the opinion built on it is a question with a testable answer. Law & Forensics retains court-tested digital forensic expert witnesses and forensic neutrals.
A conflicts check and scoping call follow, normally within one business day. Please do not send privileged or case-sensitive material until conflicts have cleared.
- Can This Artifact Prove That?
Start from the claim rather than the artifact: which records bear on it, and what no combination of them establishes.
- Computer forensics
The examination this artifact is collected and analysed in, scoped to a matter and reported so it can be tested.
- The artifact index
All 36 entries, grouped by what they bear on and filterable by platform.
- Daubert and digital evidence
Why an opinion stated one level too strongly is an admissibility problem rather than a point for cross-examination.
Attorney advertising / expert services. This page describes forensic artifacts and the procedural rules that govern expert evidence in general terms. Artifact behaviour varies by operating-system version, build, and configuration, and every observation has to be verified against the system actually in front of you. Nothing here is legal advice, and it is not a substitute for checking the rules, standing orders, and case law of your own forum.