Read the NTFS $LogFile (restart areas and log records, as recorded)

CHANGELOG.md

@@ -66,6 +66,17 @@ records, not how the code changed.
   and the QCOW2 variants Strata cannot read (external data file, subcluster
   tables, zstd compression). Tested on synthetic images only; DMG and AFF4
   are still refused.
+- **The NTFS log (`$LogFile`) can be read.** A new artefact, "NTFS log",
+  shows the log's restart areas (whether the last shutdown was clean, log
+  version, size) and its log records: LSN, transaction, the redo and undo
+  operation (name and code), and the attribute they act on. Where a record
+  adds, deletes or updates a file name and its payload is a plain
+  `$FILE_NAME` that passes sanity checks, the name, the file it refers to and
+  its four timestamps are shown too. Everything is shown as recorded: the log
+  is a ring, so it is not a full history, and Strata does not infer a
+  sequence of events from it. Torn pages are skipped and counted. Built from
+  published third-party format descriptions and tested on synthetic logs
+  only; it has not been checked against a real `$LogFile`.
 
 ### Fixed
 

README.md

@@ -94,8 +94,8 @@ alongside the classification, and the measurement window is always stated.
 
 ## Analysis
 
-**Artefacts** — sixteen parsers: volume layout, encrypted volumes, the change
-journal (`$UsnJrnl`), prefetch, shortcuts and Jump Lists, Recycle Bin,
+**Artefacts** — seventeen parsers: volume layout, encrypted volumes, the change
+journal (`$UsnJrnl`), the NTFS log (`$LogFile`, shown as recorded), prefetch, shortcuts and Jump Lists, Recycle Bin,
 well-known registry keys, shellbags, Amcache and ShimCache, browser history,
 Windows event logs, file-type verification, timeline, hashing every file,
 signature carving, and the content index. Each says what it will cost before
@@ -161,7 +161,7 @@ separate from the tool's suggestions, and never promotes one to the other.
 
 ## Not implemented
 
-EWF v2 (Ex01), FileVault, OST-specific structures, `$LogFile`, and carving
+EWF v2 (Ex01), FileVault, OST-specific structures, reconstructing events from `$LogFile`, and carving
 across fragments.
 
 ---

docs/ROADMAP.md

@@ -108,9 +108,17 @@ recognised and refused by name today; these entries are about *reading* it.
 
 ## Artefacts
 
-- [ ] **`$LogFile`** — the log NTFS keeps for crash recovery. A different
-      structure from `$UsnJrnl` and a much shorter window, but it records the
-      operations rather than a summary per file.
+- [~] **`$LogFile`** — the log NTFS keeps for crash recovery. Restart areas
+      and log records are read and shown as recorded: LSN, transaction,
+      redo/undo operation (name and code), target attribute, and a file name
+      with its timestamps where the payload of an add/delete-index-entry or
+      update-file-name record is a plain `$FILE_NAME` that passes sanity
+      checks. Built from third-party format descriptions and tested on
+      synthetic logs only — no real `$LogFile` has been checked. Not done:
+      deriving the target MFT record number, names from
+      InitializeFileRecordSegment (whole MFT records) or other operations,
+      and any reconstruction of what happened in order (deliberately left
+      out: the log is a ring and an inferred story could mislead).
 - [x] **Browser disk cache** — Chromium blockfile (what Chrome and Edge on
       Windows write for web content), Chromium Simple Cache and Firefox cache2
       entries are read (URL, status, content type, times), separate from the

engine/artifacts.py

@@ -136,6 +136,16 @@ def presence(fs, root):
                    "deleted file's name.",
         "needs": ["NTFS"],
     },
+    {
+        "id": "logfile", "label": "NTFS log ($LogFile)", "cost": MINUTES,
+        "scope": "volume", "method": "POST", "route": "logfile",
+        "per_volume": True,
+        "answers": "What NTFS's crash-recovery log still holds: recent "
+                   "transactions, the operations they performed and, where "
+                   "an entry carries one, a file name and its timestamps. "
+                   "Read as recorded; it is a ring, not a full history.",
+        "needs": ["NTFS"],
+    },
     {
         "id": "registry", "label": "Well-known registry keys", "cost": MINUTES,
         "scope": "image", "method": "POST", "route": "registry/report", "per_volume": False,