$LogFile of NTFS: A blueprint of activities

Every successful action performed in NTFS leads to update of $MFT. However, there is a chain or set of chains of transactions behind every single activity of NTFS. However, $MFT updation only shows the end product of action and corresponding chain or set of chains of transactions are not documented by it. $Logfile is the file which logs all said transactions. $MFT is a well researched area but $LogFile is relatively a less explored area. $LogFile was created by Microsoft for system recovery. However, it can also be used to get the blueprints of activities of NTFS as it logs all the transactions of NTFS. This paper deals with analysis of $LogFile used in Windows 7, its layout /structure, type of records and their decoding, explanation of information contained in these records and the techniques of reading it to extract blueprints of activities of NTFS.