Journal (File-System)
Definition
A circular log of file-system changes that allows recovery after a crash. NTFS keeps $LogFile, ext3/ext4 keep a dedicated journal block, APFS uses copy-on-write rather than a classical journal.
- Function
- Crash-recovery log of file-system changes
- NTFS mechanism
- $LogFile
- ext3/ext4 mechanism
- Dedicated journal block
- APFS mechanism
- Copy-on-write, no classic journal
Common questions
Why does APFS not need a traditional journal?+
Copy-on-write writes new data to fresh blocks and only updates pointers once the write finishes, so an interrupted write never leaves an existing structure in a half-modified state that needs replaying on recovery.
What forensic value can a file-system journal have?+
It can retain recently overwritten metadata or fragments of recent file operations that are no longer visible in the live file system, sometimes recovering evidence of activity the user believed was gone.
Related terms
- File Slack
- The unused space at the tail of the last cluster of a file. It can contain remnants of whatever previously occupied that...
- Kernel Space vs User Space
- Kernel space is the privileged execution mode where the OS schedules processes, drives hardware and enforces memory protection. User space is the...
- MAC Timestamps
- Modified, Accessed, and Changed or Created times. Different file systems use the letters differently: on POSIX it is mtime, atime, ctime (change...
- MBR vs GPT
- Master Boot Record is the legacy partition table at LBA 0, limited to 4 primary partitions and 2 TiB. GUID Partition Table...
- Volume Shadow Copy
- Windows' snapshot mechanism (VSS). Creates point-in-time copies of files and folders. Examiners find shadow copies particularly useful because users rarely know the...