Windows 8.1 Ntfs Operational Log

Kevin Stokes has a nice write-up on a newer Windows 8.1 event log that stores ntfs usage information called the “Microsoft-Windows-Ntfs/NTFS Operational” log. It was enabled in an April 2014 windows update. It logs useful information about the volume each time you plug a device in to your computer or boot creating a nice new audit trail to reference! You can read more about it on his blog



About the author

-Blog my research related to metadata, digital forensics and other technical topics.
-Develop software solutions for
-Licensed Computer Forensics Investigator for G-C Partners
-World Traveler!