| <<< The $MFTMirr | Index | NTFS Transaction Example >>> |
All instances of access to the objects on disk are considered series of transactions on NTFS. $LogFile records transaction progress.
Contains detailed info only about recent transactions -- it scrolls around in a circular fashion -- therefore, it's not the whole volume history.
Once the log is full, the first entry is overwritten with the next new entry.
Located at inode #2 of the $MFT
| <<< The $MFTMirr | Index | NTFS Transaction Example >>> |