NTFS Data Tracker: Tracking file data history based on $LogFile

Junghoon Oh, Sangjin Lee, Hyunuk Hwang

Research output: Contribution to journalArticlepeer-review

Abstract

The $LogFile is a file system metafile that stores NTFS (New Technology File System) transaction data. It is used to restore the file system to its normal state in the event of a file system error, such as one caused by sudden power outages. The transaction data recorded in $LogFile contain changes in the metadata of files and directories in the $MFT. By analyzing it, all file operations performed in the file system during a specific period can be identified. Existing research on the $LogFile has focused on finding file-level events including create, delete, move and rename. Research has also been conducted on file data in $LogFile to acquire data location information (data runs) that is initially stored at the time of file creation, or to reconstruct only the final location information of the data. No research, however, has been conducted to date on tracking the entire history of changes in the file data. In this paper, we develop a technique that reproduces changes in the metadata within the $MFT on a file-by-file basis by using transaction data recorded in the $LogFile to overcome the limitations of existing research in the area. We use this technique to track all data on the history of a given file according to changes in it over time from its creation to deletion. An NTFS Data Tracker is also developed based on the results and various example use cases are discussed.

Original languageEnglish
Article number301309
JournalForensic Science International: Digital Investigation
Volume39
DOIs
Publication statusPublished - 2021 Dec

Keywords

  • $LogFile
  • Data history
  • NTFS

ASJC Scopus subject areas

  • Computer Science Applications
  • Information Systems
  • Pathology and Forensic Medicine
  • Law
  • Medical Laboratory Technology

Fingerprint

Dive into the research topics of 'NTFS Data Tracker: Tracking file data history based on $LogFile'. Together they form a unique fingerprint.

Cite this