Concept - LogFile Restart

Overview

Each copy of the restart area is 4KB in size, and has the following structure:

Offset(length)         Description
0(4)                   Magic number 'RSTR'
1E(12)                 Fixup
30(4)                  LSNa
58(4)                  LSNb
60(4)                  LSNc (==LSNa?)
6C(1)                  Volume clear flag
78(8)                  Unicode string 'NTFS'

The purpose of the various LSNs is unclear. It appears that the data around offset 3C deal with the clear/dirty state of the volume, too.
Copyright ©