Abstract
The $LogFile is a file system metafile that stores NTFS (New Technology File System) transaction data. It is used to restore the file system to its normal state in the event of a file system error, such as one caused by sudden power outages. The transaction data recorded in $LogFile contain changes in the metadata of files and directories in the $MFT. By analyzing it, all file operations performed in the file system during a specific period can be identified. Existing research on the $LogFile has focused on finding file-level events including create, delete, move and rename. Research has also been conducted on file data in $LogFile to acquire data location information (data runs) that is initially stored at the time of file creation, or to reconstruct only the final location information of the data. No research, however, has been conducted to date on tracking the entire history of changes in the file data. In this paper, we develop a technique that reproduces changes in the metadata within the $MFT on a file-by-file basis by using transaction data recorded in the $LogFile to overcome the limitations of existing research in the area. We use this technique to track all data on the history of a given file according to changes in it over time from its creation to deletion. An NTFS Data Tracker is also developed based on the results and various example use cases are discussed.
Original language | English |
---|---|
Article number | 301309 |
Journal | Forensic Science International: Digital Investigation |
Volume | 39 |
DOIs | |
Publication status | Published - 2021 Dec |
Bibliographical note
Funding Information:None.
Publisher Copyright:
© 2021 Elsevier Ltd
Keywords
- $LogFile
- Data history
- NTFS
ASJC Scopus subject areas
- Computer Science Applications
- Information Systems
- Pathology and Forensic Medicine
- Law
- Medical Laboratory Technology