Journaling

A file system feature (e.g., in NTFS, EXT3/4) that logs changes before they’re committed, analyzed in forensics to recover data or reconstruct events after a crash or deletion.