# File system artifacts.
---
name: NTFSLogFile
doc: The NTFS $LogFile file system metadata file.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemdrive%%\$LogFile']
    separator: '\'
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/file_systems/NTFS.html']
supported_os: [Windows]
---
name: NTFSMFTFiles
doc: The NTFS $MFT and $MFTMirr file system metadata files.
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_systemdrive%%\$MFT'
    - '%%environ_systemdrive%%\$MFTMirr'
    separator: '\'
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/file_systems/NTFS.html']
supported_os: [Windows]
---
name: NTFSUSNJournal
doc: |
  The NTFS $UsnJnrl file system metadata file.

  Note that this currently does not include the $J alternate data stream name.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemdrive%%\$Extend\$UsnJrnl']
    separator: '\'
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/file_systems/NTFS.html']
supported_os: [Windows]
