NTFS Data Tracker: Tracking file data history based on $LogFile

Abstract

The $LogFile is a file system metafile that stores NTFS (New Technology File System) transaction data. It is used to restore the file system to its normal state in the event of a file system error, such as one caused by sudden power outages. The transaction data recorded in $LogFile contain changes in the metadata of files and directories in the $MFT. By analyzing it, all file operations performed in the file system during a specific period can be identified. Existing research on the $LogFile has focused on finding file-level events including create, delete, move and rename. Research has also been conducted on file data in $LogFile to acquire data location information (data runs) that is initially stored at the time of file creation, or to reconstruct only the final location information of the data. No research, however, has been conducted to date on tracking the entire history of changes in the file data. In this paper, we develop a technique that reproduces changes in the metadata within the $MFT on a file-by-file basis by using transaction data recorded in the $LogFile to overcome the limitations of existing research in the area. We use this technique to track all data on the history of a given file according to changes in it over time from its creation to deletion. An NTFS Data Tracker is also developed based on the results and various example use cases are discussed. (c) 2021 Elsevier Ltd. All rights reserved.