Activity logs
Activity logs records mount, maintenance, format and system events. It is a diagnostic surface, not a filesystem browser.
Categories
| Category | Examples |
|---|---|
| Mount | Read-only mount, write mount, unmount, failure and verification |
| Maintenance | Verify, basic repair, driver checks |
| Format | Target selection, confirmation, erase command outcome |
| System | App start, scan, update check, errors with stable codes |
What is recorded
- Timestamp, action, outcome and stable error code.
- Volume name, device node and UUID when they identify the operation.
- Command name and duration. Raw command output is treated as log material.
- Settings that changed the behavior of an operation.
What is never recorded
- File contents or file names inside an NTFS volume.
- Passwords, tokens or administrator credentials.
- A raw command error as the only user-facing message. The UI shows a readable message and code; the raw text stays in the log.
Using the log view
- Filter by category or free text.
- Select a log file to inspect its tail.
- Copy the selected text for a support report.
- Export a diagnostics ZIP only when you choose to.
Logs live in ~/Library/Logs/NTFS Kit/ and rotate by size and count. The diagnostics ZIP can contain local paths and volume names; review it before sharing.