Editing NTFS (section)

=== Journaling ===
NTFS is a [[journaling file system]] and uses the NTFS Log ({{mono|$LogFile}}) to record metadata changes to the volume. It is a feature that FAT does not provide and is critical for NTFS to ensure that its complex internal data structures will remain consistent in case of system crashes or data moves performed by the [[defragmentation]] API, and allow easy rollback of uncommitted changes to these critical data structures when the volume is remounted. Notably affected structures are the volume allocation bitmap, modifications to [[#Master File Table|MFT]] records such as moves of some variable-length attributes stored in MFT records and attribute lists, and indices for directories and [[security descriptor]]s.

The ({{mono|$LogFile}}) format has evolved through several versions:

{| class="wikitable"
!Windows Version
!{{mono|$LogFile}} format version
|-
|{{rh}}|[[Windows NT 4.0]]
|rowspan="5"|1.1
|-
|{{rh}}|[[Windows 2000]]
|-
|{{rh}}|[[Windows XP]]
|-
|{{rh}}|[[Windows Vista]]
|-
|{{rh}}|[[Windows 7]]
|-
|{{rh}}|[[Windows 8]]
|rowspan="3"|2.0
|-
|{{rh}}|[[Windows 8.1]]
|-
|{{rh}}|[[Windows 10]]
|}

The incompatibility of the {{mono|$LogFile}} versions implemented by [[Windows 8]], [[Windows 10]], [[Windows 11]] prevents [[Windows 7]] (and earlier versions of Windows) from recognizing version 2.0 of the {{mono|$LogFile}}. Backward compatibility is provided by downgrading the {{mono|$LogFile}} to version 1.1 when an NTFS volume is cleanly dismounted. It is again upgraded to version 2.0 when mounting on a compatible version of Windows. However, when hibernating to disk in the logoff state (a.k.a. Hybrid Boot or Fast Boot, which is enabled by default), mounted file systems are not dismounted, and thus the {{mono|$LogFile}}s of any active file systems are not downgraded to version 1.1. The inability to process version 2.0 of the {{mono|$LogFile}} by versions of Windows older than 8.0 results in an unnecessary invocation of the [[CHKDSK]] disk repair utility. This is particularly a concern in a [[multi-boot]] scenario involving pre- and post-8.0 versions of Windows, or when frequently moving a storage device between older and newer versions. A [[Windows Registry]] setting exists to prevent the automatic upgrade of the {{mono|$LogFile}} to the newer version. The problem can also be dealt with by disabling Hybrid Boot.<ref>{{Cite web|url=https://learn.microsoft.com/en-us/archive/technet-wiki/15645.windows-8-volume-compatibility-considerations-with-prior-versions-of-windows|title=Windows 8 volume compatibility considerations with prior versions of Windows|date=17 January 2024 |access-date=2024-08-08}}</ref>

The [[USN Journal]] (Update Sequence Number Journal) is a system management feature that records (in {{mono|$Extend\$UsnJrnl}}) changes to files, streams and directories on the volume, as well as their various attributes and security settings. The journal is made available for applications to track changes to the volume.<ref>{{cite web|url=https://learn.microsoft.com/en-us/windows/win32/fileio/change-journals|title=Change Journals|date=7 January 2021 |website=[[Microsoft Learn]]|publisher=[[Microsoft]]|access-date=2023-08-12}}</ref> This journal can be enabled or disabled on non-system volumes.<ref>{{cite web|url=https://learn.microsoft.com/en-us/windows/win32/fileio/creating-modifying-and-deleting-a-change-journal|title=Creating, Modifying, and Deleting a Change Journal (Windows)|date=7 January 2021 |website=[[Microsoft Learn]]|publisher=[[Microsoft]]|access-date=2023-08-12}}</ref>