Embedded UsnJrnl entry in $LogFile

General (Technical, Procedural, Software, Hardware etc.)

Last Post by joakims 8 years ago

2 Posts

2 Users

0 Reactions

761 Views

RSS

mrthaggar

(@mrthaggar)

Active Member

Joined: 17 years ago

Posts: 11

Topic starter 29/05/2018 1:06 pm [#16678]

I'm just working with some NTFS $LogFile data, and I've come across an interesting portion. According to this document NTFS-Linker if the Redo op is 'UpdateNonResidentData' and the undo op is 'NoOp', then the client data should contain an embedded UsnJrnl entry. However, looking at the data, something doesn't look right.

This is the a screenshot of the data. Image of data

The arrow is pointing to the start of the 'ClientData' portion, which is reported to be 40 bytes in length. However, it looks like the next LSN header, but there's an extra '0xAB2A' in there, so it's either a corrupt entry, or it's the embedded UsnJrnl entry, but I can't seem to determine the correct structure for it.

If anyone has any experience with sort of thing, I'd greatly appreciate some feedback.

Thanks

Quote

joakims

(@joakims)

Estimable Member

Joined: 16 years ago

Posts: 224

30/05/2018 6:30 am

As a comparison you might want to decode the file using https://github.com/jschicht/LogFileParser If that tool can't analyze the UsnJrnl entry for you, please let me know.

ReplyQuote