ntfs-logfile
Retrieves information such as file name, creation/modification/access time, and redo/undo operation type in a NTFS transaction log file. With this command, you can see the history of file creation, deletion and renaming.
Syntax
ntfs-logfile [zipcharset=CHARSET] [zippath=ZIPFILE_PATH] FILE_PATH
Required Parameter
FILE_PATH
- Path to the NTFS log file. Using a wildcard (
*
) in the file name, you can retrieve all files containing a specific string pattern in the file name (e.g.D:\data\NTFS\*
). If you provided thezippath
option, input the NTFS file path in the ZIP file.
Optional Parameter
zipcharset=CHARSET
- Character set to be used to decode the ZIP entry name and comment that are not encoded by UTF-8 encoding. Use the preferred MIME name or aliases registered in the following document: http://www.iana.org/assignments/character-sets/character-sets.xhtml
zippath=ZIPFILE_PATH
- The path to the ZIP file.
Description
Output Fields
After running the ntfs-logfile
command, the output fields are as follows:
Field | Type | Description |
---|---|---|
access_at | Date | Last access time |
client_data_length | Integer | Record volume |
created_at | Date | Time of creation |
file_name | String | File name |
flags | Integer | Flag |
lsn | Integer | Log file sequence number |
mft_head | String | MFT header |
mft_link_count | Integer | Number of entries referencing the corresponding file |
mft_lsn | Integer | MFT log file sequence number |
modified_at | Date | Last modification time |
page | Integer | Page number |
prev_lsn | Integer | Previous log file sequence number |
record_type | Integer | Record type (2 : checkpoint record, 1 : other records) |
redo_len | Integer | Size of redo data |
redo_offset | Integer | Offset of redo data |
redo_op | String | Redo operation code |
undo_len | Integer | Size of undo data |
undo_offset | Integer | Offset of undo data |
undo_op | String | Undo operation code |
Redo_op and Undo_op Operation Codes
Operation Codes output to the redo_op and undo_op fields are as follows:
redo_op /undo_op | Hex value |
---|---|
noop | 0x00 |
compensation_log_record | 0x1 |
initialize_file_record_segment | 0x2 |
deallocate_file_record_segment | 0x3 |
write_end_of_file_record_segment | 0x4 |
create_attribute | 0x5 |
delete_attribute | 0x6 |
update_resident_value | 0x7 |
update_non_resident_value | 0x8 |
update_mapping_pairs | 0x9 |
delete_dirty_clusters | 0xa |
set_new_attribute_size | 0xb |
add_index_entry_root | 0xc |
delete_index_entry_root | 0xd |
add_index_entry_allocation | 0xe |
delete_index_entry_allocation | 0xf |
set_index_entry_ven_allocation | 0x12 |
update_file_name_root | 0x13 |
update_file_name_allocation | 0x14 |
set_bits_in_non_resident_bitmap | 0x15 |
clear_bits_in_non_resident_bitmap | 0x16 |
prepare_transaction | 0x19 |
commit_transaction | 0x1a |
forget_transaction | 0x1b |
open_non_resident_attribute | 0x1c |
open_attribute_table_dump | 0x1d |
dirty_page_table_dump | 0x1f |
transaction_table_dump | 0x20 |
update_record_data_root | 0x21 |
Usage
-
Retrieve by providing a file path.
ntfs-logfile D:\data\NTFS\test_LogFile
-
Retrieve when the
zippath
option is provided.ntfs-logfile zippath=D:\data\NTFS.zip NTFS\test_LogFile
-
Retrieve logs where the
redo_op
is related to anyinitialize_file_record_segment
ordelete
operation.ntfs-logfile D:\data\NTFS\test_LogFile | sort lsn | search redo_op == "initialize_file_record_segment" or redo_op == "*delete*"