How do I locate the $Logfile

[XiaClumio]

Hello,

I was trying out your software but I couldn't open or even see the $Logfile as it seems to be hidden by the windows OS. Could you please share instructions how to make $Logfile visible to your program?

Thanks,
Xia
Email: xia@clumio.com

[Frostarr]

Hello,

You can locate and extract it using tools as FTK (add evidence ->logical drive -> Select the NTFS volume), you can find $LogFile, $MFT, or other protected NTFS files in the [root] directory.

Good luck

[mirh]

You can use Autopsy as a free tool.

[tigros]

DiskGenius works, click View/Show Metafiles, right click $Logfile and Copy To, just don't copy it to a root folder, change the copy's attributes.