diff --git a/ntfsprogs/ntfsdump_logfile.c b/ntfsprogs/ntfsdump_logfile.c
index 915514d6..205711db 100644
--- a/ntfsprogs/ntfsdump_logfile.c
+++ b/ntfsprogs/ntfsdump_logfile.c
@@ -22,6 +22,13 @@
  * in the file COPYING); if not, write to the Free Software Foundation,
  * Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
+/* TODO:
+ *	- Remove the need for clipping at 64MiB.
+ *	- Add normal command line switchs (use getopt_long()).
+ *	- For a volume: allow dumping only uncommited records.
+ *	- For a file:   get an optional command line parameter for the last SN.
+ *	- Sanity checks.
+ */
 
 #include "config.h"
 
@@ -43,14 +50,61 @@
 #include "layout.h"
 #include "logfile.h"
 #include "mst.h"
+#include "utils.h"
+
+typedef struct {
+	BOOL is_volume;
+	const char *filename;
+	s64 data_size;
+	union {
+		struct {
+			ntfs_volume *vol;
+			ntfs_inode *ni;
+			ntfs_attr *na;
+		};
+		struct {
+			int fd;
+		};
+	};
+} logfile_file;
+
+GEN_PRINTF (Eprintf, stderr, NULL, FALSE)
 
 /**
- * device_err_exit -
+ * logfile_close
  */
-void device_err_exit(char *dev_name, ntfs_volume *vol, ntfs_inode *ni,
+static int logfile_close(logfile_file *logfile)
+{
+	if (logfile->is_volume) {
+		if (logfile->na)
+			ntfs_attr_close(logfile->na);
+		if (logfile->ni && ntfs_inode_close(logfile->ni))
+			Eprintf("Warning: Failed to close $LogFile (inode %i):"
+				" %s\n", FILE_LogFile, strerror(errno));
+		if (ntfs_umount(logfile->vol, 0))
+			Eprintf("Warning: Failed to umount %s: %s\n",
+				logfile->filename, strerror(errno));
+	} else {
+		if (close(logfile->fd))
+			Eprintf("Warning: Failed to close file %s: %s\n",
+				logfile->filename, strerror(errno));
+	}
+	return 0;
+}
+
+/**
+ * device_err_exit - put an error message, cleanup and exit.
+ * @vol: volume to unmount.
+ * @ni:  Inode to free.
+ * @na:  Attribute to close.
+ *
+ * Use when you wish to exit and collate all the cleanups together.
+ * if you don't have some parameter to pass, just pass NULL.
+ */
+void device_err_exit(ntfs_volume *vol, ntfs_inode *ni,
 		ntfs_attr *na, const char *fmt, ...) __attribute__ ((noreturn))
-		__attribute__((format(printf, 5, 6)));
-void device_err_exit(char *dev_name, ntfs_volume *vol, ntfs_inode *ni,
+		__attribute__ ((format(printf, 4, 5)));
+void device_err_exit(ntfs_volume *vol, ntfs_inode *ni,
 		ntfs_attr *na, const char *fmt, ...)
 {
 	va_list ap;
@@ -58,16 +112,17 @@ void device_err_exit(char *dev_name, ntfs_volume *vol, ntfs_inode *ni,
 	if (na)
 		ntfs_attr_close(na);
 	if (ni && ntfs_inode_close(ni))
-		fprintf(stderr, "Warning: Failed to close $LogFile (inode "
-				"%i): %s\n", FILE_LogFile, strerror(errno));
+		Eprintf("Warning: Failed to close $LogFile (inode %i): %s\n",
+			FILE_LogFile, strerror(errno));
 	if (ntfs_umount(vol, 0))
-		fprintf(stderr, "Warning: Failed to umount %s: %s\n",
-				dev_name, strerror(errno));
+		Eprintf("Warning: Failed to umount: %s\n", strerror(errno));
+
 	fprintf(stderr, "ERROR: ");
 	va_start(ap, fmt);
 	vfprintf(stderr, fmt, ap);
 	va_end(ap);
-	fprintf(stderr, "Aborting...\n");
+
+	Eprintf("Aborting...\n");
 	exit(1);
 }
 
@@ -82,11 +137,13 @@ void log_err_exit(u8 *buf, const char *fmt, ...)
 
 	if (buf)
 		free(buf);
+
 	fprintf(stderr, "ERROR: ");
 	va_start(ap, fmt);
 	vfprintf(stderr, fmt, ap);
 	va_end(ap);
-	fprintf(stderr, "Aborting...\n");
+
+	Eprintf("Aborting...\n");
 	exit(1);
 }
 
@@ -96,180 +153,122 @@ void log_err_exit(u8 *buf, const char *fmt, ...)
 void usage(const char *exec_name) __attribute__ ((noreturn));
 void usage(const char *exec_name)
 {
-	fprintf(stderr, "%s v%s - Interpret and display information about the "
-			"journal\n($LogFile) of an NTFS volume.\n"
-			"Copyright (c) 2000-2004 Anton Altaparmakov.\n"
-			"%s is free software, released under the GNU General "
-			"Public License\nand you are welcome to redistribute "
-			"it under certain conditions.\n%s comes with "
-			"ABSOLUTELY NO WARRANTY; for details read the GNU\n"
-			"General Public License to be found in the file "
-			"COPYING in the main Linux-NTFS\ndistribution "
-			"directory.\nUsage: %s device\n    e.g. %s /dev/hda6\n"
-			"Alternative usage: %s -f file\n    e.g. %s -f "
-			"MyCopyOfTheLogFile\n", exec_name, VERSION, exec_name,
-			exec_name, exec_name, exec_name, exec_name, exec_name);
+	Eprintf("%s v%s - Interpret and display information about the "
+		"journal\n($LogFile) of an NTFS volume.\n"
+		"Copyright (c) 2000-2004 Anton Altaparmakov.\n"
+		"%s is free software, released under the GNU General "
+		"Public License\nand you are welcome to redistribute "
+		"it under certain conditions.\n%s comes with "
+		"ABSOLUTELY NO WARRANTY; for details read the GNU\n"
+		"General Public License to be found in the file "
+		"COPYING in the main Linux-NTFS\ndistribution "
+		"directory.\nUsage: %s device\n    e.g. %s /dev/hda6\n"
+		"Alternative usage: %s -f file\n    e.g. %s -f "
+		"MyCopyOfTheLogFile\n", exec_name, VERSION, exec_name,
+		exec_name, exec_name, exec_name, exec_name, exec_name);
 	exit(1);
 }
 
 /**
- * main -
+ * logfile_open
  */
-int main(int argc, char **argv)
+static int logfile_open(BOOL is_volume, const char *filename,
+		logfile_file *logfile)
 {
-	u8 *buf;
-	RESTART_PAGE_HEADER *rstr;
-	RESTART_AREA *ra;
-	LOG_CLIENT_RECORD *lcr;
-	RECORD_PAGE_HEADER *rcrd;
-	LOG_RECORD *lr;
-	int buf_size, err, client, pass = 1;
-	unsigned int page_size, usa_end_ofs, i;
-
-	printf("\n");
-	if (argc < 2 || argc > 3)
-		usage(argv[0]);
-	/*
-	 * If one argument, it is a device containing an NTFS volume which we
-	 * need to mount and read the $LogFile from so we can dump its contents.
-	 *
-	 * If two arguments the first one must be "-f" and the second one is
-	 * the path and name of the $LogFile (or copy thereof) which we need to
-	 * read and dump the contents of.
-	 */
-	if (argc == 2) {
-		s64 br;
+	if (is_volume) {
 		ntfs_volume *vol;
 		ntfs_inode *ni;
 		ntfs_attr *na;
 
-		vol = ntfs_mount(argv[1], MS_RDONLY);
+		vol = ntfs_mount(filename, MS_RDONLY);
 		if (!vol)
-			log_err_exit(NULL, "Failed to mount %s: %s\n", argv[1],
-					strerror(errno));
-		printf("\nMounted NTFS volume %s (NTFS v%i.%i) on device %s.\n",
+			log_err_exit(NULL, "Failed to mount %s: %s\n",
+					filename, strerror(errno));
+		printf("Mounted NTFS volume %s (NTFS v%i.%i) on device %s.\n",
 				vol->vol_name ? vol->vol_name : "<NO_NAME>",
-				vol->major_ver, vol->minor_ver, argv[1]);
+				vol->major_ver, vol->minor_ver, filename);
 		if (ntfs_version_is_supported(vol))
-			device_err_exit(argv[1], vol, NULL, NULL,
+			device_err_exit(vol, NULL, NULL,
 					"Unsupported NTFS version.\n");
 		ni = ntfs_inode_open(vol, FILE_LogFile);
 		if (!ni)
-			device_err_exit(argv[1], vol, NULL, NULL, "Failed to "
+			device_err_exit(vol, NULL, NULL, "Failed to "
 					"open $LogFile (inode %i): %s\n",
 					FILE_LogFile, strerror(errno));
 		na = ntfs_attr_open(ni, AT_DATA, AT_UNNAMED, 0);
 		if (!na)
-			device_err_exit(argv[1], vol, ni, NULL, "Failed to "
-					"open $LogFile/$DATA (attribute "
-					"0x%x): %s\n",
-					(unsigned int)le32_to_cpu(AT_DATA),
-					strerror(errno));
+			device_err_exit(vol, ni, NULL, "Failed to open "
+					"$LogFile/$DATA (attribute 0x%x):"
+					" %s\n", (unsigned int)
+					le32_to_cpu(AT_DATA), strerror(errno));
 		if (!na->data_size)
-			device_err_exit(argv[1], vol, ni, na, "$LogFile has "
-					"zero length.  Run chkdsk /f to "
-					"correct this.\n");
-		if (na->data_size <= 64 * 1024 * 1024)
-			buf_size = na->data_size;
-		else {
-			fprintf(stderr, "Warning: $LogFile is too big.  Only "
-					"analysing the first 64MiB.\n");
-			buf_size = 64 * 1024 * 1024;
-		}
-		/* For simplicity we read all of $LogFile/$DATA into memory. */
-		buf = malloc(buf_size);
-		if (!buf)
-			device_err_exit(argv[1], vol, ni, na, "Failed to "
-					"allocate buffer for $LogFile/$DATA: "
-					"%s", strerror(errno));
-		br = ntfs_attr_pread(na, 0, buf_size, buf);
-		if (br != buf_size) {
-			free(buf);
-			device_err_exit(argv[1], vol, ni, na, "Failed to read "
-					"$LogFile/$DATA: %s", br < 0 ?
-					strerror(errno) : "Partial read.");
-		}
-		ntfs_attr_close(na);
-		if (ntfs_inode_close(ni))
-			fprintf(stderr, "Warning: Failed to close $LogFile "
-					"(inode %i): %s\n", FILE_LogFile,
-					strerror(errno));
-		if (ntfs_umount(vol, 0))
-			fprintf(stderr, "Warning: Failed to umount %s: %s\n",
-					argv[1], strerror(errno));
-	} else /* if (argc == 3) */ {
-		ssize_t br;
-		int fd;
+			device_err_exit(vol, ni, na, "$LogFile has zero "
+					"length.  Run chkdsk /f to correct "
+					"this.\n");
+		logfile->data_size = na->data_size;
+		logfile->vol = vol;
+		logfile->ni = ni;
+		logfile->na = na;
+	} else {
 		struct stat sbuf;
+		int fd;
 
-		if (strncmp(argv[1], "-f", strlen("-f")))
-			usage(argv[0]);
-		if (stat(argv[2], &sbuf) == -1) {
+		if (stat(filename, &sbuf) == -1) {
 			if (errno == ENOENT)
 				log_err_exit(NULL, "The file %s does not "
 						"exist.  Did you specify it "
-						"correctly?\n", argv[2]);
+						"correctly?\n", filename);
 			log_err_exit(NULL, "Error getting information about "
-					"%s: %s\n", argv[2], strerror(errno));
+					"%s: %s\n", filename, strerror(errno));
 		}
-		if (sbuf.st_size <= 64 * 1024 * 1024)
-			buf_size = sbuf.st_size;
-		else {
-			fprintf(stderr, "Warning: File %s is too big.  Only "
-					"analysing the first 64MiB.\n",
-					argv[2]);
-			buf_size = 64 * 1024 * 1024;
-		}
-		/* For simplicity we read all of the file into memory. */
-		buf = malloc(buf_size);
-		if (!buf)
-			log_err_exit(NULL, "Failed to allocate buffer for "
-					"file data: %s", strerror(errno));
-		fd = open(argv[2], O_RDONLY);
+
+		fd = open(filename, O_RDONLY);
 		if (fd == -1)
 			log_err_exit(NULL, "Failed to open file %s: %s\n",
-					argv[2], strerror(errno));
-		/* Read in the file into the buffer. */
-		br = read(fd, buf, buf_size);
-		err = errno;
-		if (close(fd))
-			fprintf(stderr, "Warning: Failed to close file %s: "
-					"%s\n", argv[2], strerror(errno));
-		if (br != buf_size)
-			log_err_exit(buf, "Failed to read data from %s: %s",
-					argv[2], br < 0 ? strerror(err) :
-					"Partial read.");
+					filename, strerror(errno));
+		logfile->data_size = sbuf.st_size;
+		logfile->fd = fd;
 	}
-	/*
-	 * We now have the entirety of the journal ($LogFile/$DATA or argv[2])
-	 * in the memory buffer buf and this has a size of buf_size.  Note we
-	 * apply a size capping at 64MiB, so if the journal is any bigger we
-	 * only have the first 64MiB.  This should not be a problem as I have
-	 * never seen such a large $LogFile.  Usually it is only a few MiB in
-	 * size.
-	 */
-	rstr = (RESTART_PAGE_HEADER*)buf;
-	/* Check for presence of restart area signature. */
-	if (!ntfs_is_rstr_record(rstr->magic) &&
-			!ntfs_is_chkd_record(rstr->magic)) {
-		s8 *pos = (s8*)buf;
-		s8 *end = pos + buf_size;
-		while (pos < end && *pos == -1)
-			pos++;
-		if (pos != end)
-			log_err_exit(buf, "$LogFile contents are corrupt "
-					"(magic RSTR is missing).  Cannot "
-					"handle this yet.\n");
-		/* All bytes are -1. */
-		free(buf);
-		puts("$LogFile is not initialized.");
-		return 0;
+
+	logfile->is_volume = is_volume;
+	logfile->filename = filename;
+
+	return 0;
+}
+
+/**
+ * logfile_read
+ */
+static int logfile_pread(logfile_file *logfile, int ofs, int count, u8 *buf)
+{
+	int br;
+
+	if (logfile->is_volume) {
+		br = (int)ntfs_attr_pread(logfile->na, ofs, count, buf);
+	} else {
+		if (lseek(logfile->fd, ofs, SEEK_SET)==-1) {
+			Eprintf("Could not seek to offset %u\n", ofs);
+			return 0;
+		}
+		br = read(logfile->fd, buf, count);
 	}
-	/*
-	 * First, verify the restart page header for consistency.
-	 */
+	if (br != count) {
+		Eprintf("Only %d out of %d bytes read starting at %d\n",
+			br, count, ofs);
+	}
+	return br;
+}
+
+/**
+ * restart_header_sanity()
+ */
+static void restart_header_sanity(RESTART_PAGE_HEADER *rstr, u8 *buf)
+{
+	unsigned int usa_end_ofs, page_size;
+
 	/* Only CHKD records are allowed to have chkdsk_lsn set. */
-	if (!ntfs_is_chkd_record(rstr->magic) && sle64_to_cpu(rstr->chkdsk_lsn))
+	if (!ntfs_is_chkd_record(rstr->magic) &&
+			sle64_to_cpu(rstr->chkdsk_lsn))
 		log_err_exit(buf, "$LogFile is corrupt:  Restart page header "
 				"magic is not CHKD but a chkdsk LSN is "
 				"specified.  Cannot handle this yet.\n");
@@ -321,68 +320,10 @@ int main(int argc, char **argv)
 				"corrupt:  Restart area offset is not aligned "
 				"to 8-byte boundary.  Cannot handle this "
 				"yet.\n");
-	/*
-	 * Second, verify the restart area itself.
-	 */
-	// TODO: Implement this.
-	fprintf(stderr, "Warning:  Sanity checking of restart area not "
-			"implemented yet.\n");
-	/*
-	 * Third and last, verify the array of log client records.
-	 */
-	// TODO: Implement this.
-	fprintf(stderr, "Warning:  Sanity checking of array of log client "
-			"records not implemented yet.\n");
-rstr_pass_loc:
-	if (ntfs_is_chkd_record(rstr->magic))
-		log_err_exit(buf, "The %s restart page header in $LogFile has "
-				"been modified by chkdsk.  Do not know how to "
-				"handle this yet.  Reboot into Windows to fix "
-				"this.\n", (u8*)rstr == buf ? "first" :
-				"second");
-	if (ntfs_mst_post_read_fixup((NTFS_RECORD*)rstr, page_size) ||
-			ntfs_is_baad_record(rstr->magic))
-		log_err_exit(buf, "$LogFile incomplete multi sector transfer "
-				"detected in restart page header.  Cannot "
-				"handle this yet.\n");
-	if (pass == 1)
-		printf("$LogFile version %i.%i.\n",
-				sle16_to_cpu(rstr->major_ver),
-				sle16_to_cpu(rstr->minor_ver));
-	else /* if (pass == 2) */ {
-		/*
-		 * rstr is now the second restart page so we declare rstr1
-		 * as the first restart page as this one has been verified in
-		 * the first pass so we can use all its members safely.
-		 */
-		RESTART_PAGE_HEADER *rstr1 = (RESTART_PAGE_HEADER*)buf;
+}
 
-		/* Exclude the usa from the comparison. */
-		ra = (RESTART_AREA*)((u8*)rstr1 +
-				le16_to_cpu(rstr1->restart_offset));
-		if (!memcmp(rstr1, rstr, le16_to_cpu(rstr1->usa_ofs)) &&
-				!memcmp((u8*)rstr1 + le16_to_cpu(
-				rstr1->restart_offset), (u8*)rstr +
-				le16_to_cpu(rstr->restart_offset),
-				le16_to_cpu(ra->restart_area_length))) {
-			puts("\nSkipping analysis of second restart page "
-					"because it fully matches the first "
-					"one.");
-			goto skip_rstr_pass;
-		}
-		/*
-		 * The $LogFile versions specified in each of the two restart
-		 * page headers must match.
-		 */
-		if (rstr1->major_ver != rstr->major_ver ||
-				rstr1->minor_ver != rstr->minor_ver)
-			log_err_exit(buf, "Second restart area specifies "
-					"different $LogFile version to first "
-					"restart area.  Cannot handle this "
-					"yet.\n");
-	}
-	/* The restart page header is in rstr and it is mst deprotected. */
-	printf("\n%s restart page:\n", pass == 1 ? "1st" : "2nd");
+static void dump_restart_areas_header(RESTART_PAGE_HEADER *rstr)
+{
 	printf("\nRestart page header:\n");
 	printf("magic = %s\n", ntfs_is_rstr_record(rstr->magic) ? "RSTR" :
 			"CHKD");
@@ -402,7 +343,14 @@ rstr_pass_loc:
 	printf("restart_offset = %u (0x%x)\n",
 			le16_to_cpu(rstr->restart_offset),
 			le16_to_cpu(rstr->restart_offset));
-	printf("\nRestart area:\n");
+}
+
+static void dump_restart_areas_area(RESTART_PAGE_HEADER *rstr)
+{
+	LOG_CLIENT_RECORD *lcr;
+	RESTART_AREA *ra;
+	int client;
+
 	ra = (RESTART_AREA*)((u8*)rstr + le16_to_cpu(rstr->restart_offset));
 	printf("current_lsn = %lli (0x%llx)\n",
 			(long long)sle64_to_cpu(ra->current_lsn),
@@ -481,55 +429,89 @@ rstr_pass_loc:
 		 */
 		lcr++;
 	}
+}
+
+/**
+ * dump_restart_areas()
+ */
+static void *dump_restart_areas(RESTART_PAGE_HEADER *rstr, u8 *buf,
+		unsigned int page_size)
+{
+	int pass = 1;
+
+rstr_pass_loc:
+	if (ntfs_is_chkd_record(rstr->magic))
+		log_err_exit(buf, "The %s restart page header in $LogFile has "
+				"been modified by chkdsk.  Do not know how to "
+				"handle this yet.  Reboot into Windows to fix "
+				"this.\n", (u8*)rstr == buf ? "first" :
+				"second");
+	if (ntfs_mst_post_read_fixup((NTFS_RECORD*)rstr, page_size) ||
+			ntfs_is_baad_record(rstr->magic))
+		log_err_exit(buf, "$LogFile incomplete multi sector transfer "
+				"detected in restart page header.  Cannot "
+				"handle this yet.\n");
+	if (pass == 1)
+		printf("$LogFile version %i.%i.\n",
+				sle16_to_cpu(rstr->major_ver),
+				sle16_to_cpu(rstr->minor_ver));
+	else /* if (pass == 2) */ {
+		RESTART_AREA *ra;
+
+		/*
+		 * rstr is now the second restart page so we declare rstr1
+		 * as the first restart page as this one has been verified in
+		 * the first pass so we can use all its members safely.
+		 */
+		RESTART_PAGE_HEADER *rstr1 = (RESTART_PAGE_HEADER*)buf;
+
+		/* Exclude the usa from the comparison. */
+		ra = (RESTART_AREA*)((u8*)rstr1 +
+				le16_to_cpu(rstr1->restart_offset));
+		if (!memcmp(rstr1, rstr, le16_to_cpu(rstr1->usa_ofs)) &&
+				!memcmp((u8*)rstr1 + le16_to_cpu(
+				rstr1->restart_offset), (u8*)rstr +
+				le16_to_cpu(rstr->restart_offset),
+				le16_to_cpu(ra->restart_area_length))) {
+			puts("\nSkipping analysis of second restart page "
+					"because it fully matches the first "
+					"one.");
+			goto skip_rstr_pass;
+		}
+		/*
+		 * The $LogFile versions specified in each of the two restart
+		 * page headers must match.
+		 */
+		if (rstr1->major_ver != rstr->major_ver ||
+				rstr1->minor_ver != rstr->minor_ver)
+			log_err_exit(buf, "Second restart area specifies "
+					"different $LogFile version to first "
+					"restart area.  Cannot handle this "
+					"yet.\n");
+	}
+	/* The restart page header is in rstr and it is mst deprotected. */
+	printf("\n%s restart page:\n", pass == 1 ? "1st" : "2nd");
+	dump_restart_areas_header(rstr);
+
+	printf("\nRestart area:\n");
+	dump_restart_areas_area(rstr);
+
 skip_rstr_pass:
 	if (pass == 1) {
 		rstr = (RESTART_PAGE_HEADER*)((u8*)rstr + page_size);
 		++pass;
 		goto rstr_pass_loc;
 	}
-	printf("\n\nFinished with restart pages.  Beginning with log pages.\n");
-	/* Reuse pass for log area. */
-	pass = 0;
-	rcrd = (RECORD_PAGE_HEADER*)rstr;
-rcrd_pass_loc:
-	rcrd = (RECORD_PAGE_HEADER*)((u8*)rcrd + page_size);
-	if ((u8*)rcrd + page_size > buf + buf_size)
-		goto end_of_rcrd_passes;
-	printf("\nLog record page number %i", pass);
-	if (!ntfs_is_rcrd_record(rcrd->magic) &&
-			!ntfs_is_chkd_record(rcrd->magic)) {
-		for (i = 0; i < page_size; i++)
-			if (((u8*)rcrd)[i] != (u8)-1)
-				break;
-		if (i < page_size)
-			puts(" is corrupt (magic is not RCRD or CHKD).");
-		else
-			puts(" is empty.");
-		pass++;
-		goto rcrd_pass_loc;
-	} else
-		puts(":");
-	/* Dump log record page */
-	printf("magic = %s\n", ntfs_is_rcrd_record(rcrd->magic) ? "RCRD" :
-			"CHKD");
-// TODO: I am here... (AIA)
-	printf("copy.last_lsn/file_offset = 0x%llx\n", (unsigned long long)
-			le64_to_cpu(rcrd->copy.last_lsn));
-	printf("flags = 0x%x\n", (unsigned int)le32_to_cpu(rcrd->flags));
-	printf("page count = %i\n", le16_to_cpu(rcrd->page_count));
-	printf("page position = %i\n", le16_to_cpu(rcrd->page_position));
-	printf("header.next_record_offset = 0x%llx\n", (unsigned long long)
-			le64_to_cpu(rcrd->header.packed.next_record_offset));
-	printf("header.last_end_lsn = 0x%llx\n", (unsigned long long)
-			le64_to_cpu(rcrd->header.packed.last_end_lsn));
-	/*
-	 * Where does the 0x40 come from? Is it just usa_offset +
-	 * usa_client * 2 + 7 & ~7 or is it derived from somewhere?
-	 */
-	lr = (LOG_RECORD*)((u8*)rcrd + 0x40);
-	client = 0;
-log_record_pass:
-	printf("\nLog record %i:\n", client);
+	
+	return rstr;
+}
+
+/**
+ * dump_log_records()
+ */
+static void dump_log_record(LOG_RECORD *lr)
+{
+	unsigned int i;
 	printf("this lsn = 0x%llx\n",
 			(unsigned long long)le64_to_cpu(lr->this_lsn));
 	printf("client previous lsn = 0x%llx\n", (unsigned long long)
@@ -578,16 +560,189 @@ log_record_pass:
 	if (le16_to_cpu(lr->lcns_to_follow) > 0)
 		printf("Array of lcns:\n");
 	for (i = 0; i < le16_to_cpu(lr->lcns_to_follow); i++)
-		printf("lcn_list[%i].lcn = 0x%llx\n", i, (unsigned long long)
+		printf("lcn_list[%u].lcn = 0x%llx\n", i, (unsigned long long)
 				sle64_to_cpu(lr->lcn_list[i].lcn));
-	client++;
-	lr = (LOG_RECORD*)((u8*)lr + 0x70);
-	if (((u8*)lr + 0x70 <= (u8*)rcrd +
-			le64_to_cpu(rcrd->header.packed.next_record_offset)))
-		goto log_record_pass;
+}
+
+/**
+ * dump_log_records()
+ */
+static void dump_log_records(RECORD_PAGE_HEADER *rcrd, u8 *buf,
+		int buf_size, unsigned int page_size)
+{
+	LOG_RECORD *lr;
+	int pass = 0;
+	int client;
+
+	/* Reuse pass for log area. */
+rcrd_pass_loc:
+	rcrd = (RECORD_PAGE_HEADER*)((u8*)rcrd + page_size);
+	if ((u8*)rcrd + page_size > buf + buf_size)
+		return;
+	printf("\nLog record page number %i", pass);
+	if (!ntfs_is_rcrd_record(rcrd->magic) &&
+			!ntfs_is_chkd_record(rcrd->magic)) {
+		unsigned int i;
+		for (i = 0; i < page_size; i++)
+			if (((u8*)rcrd)[i] != (u8)-1)
+				break;
+		if (i < page_size)
+			puts(" is corrupt (magic is not RCRD or CHKD).");
+		else
+			puts(" is empty.");
+		pass++;
+		goto rcrd_pass_loc;
+	} else
+		puts(":");
+	/* Dump log record page */
+	printf("magic = %s\n", ntfs_is_rcrd_record(rcrd->magic) ? "RCRD" :
+			"CHKD");
+// TODO: I am here... (AIA)
+	printf("copy.last_lsn/file_offset = 0x%llx\n", (unsigned long long)
+			le64_to_cpu(rcrd->copy.last_lsn));
+	printf("flags = 0x%x\n", (unsigned int)le32_to_cpu(rcrd->flags));
+	printf("page count = %i\n", le16_to_cpu(rcrd->page_count));
+	printf("page position = %i\n", le16_to_cpu(rcrd->page_position));
+	printf("header.next_record_offset = 0x%llx\n", (unsigned long long)
+			le64_to_cpu(rcrd->header.packed.next_record_offset));
+	printf("header.last_end_lsn = 0x%llx\n", (unsigned long long)
+			le64_to_cpu(rcrd->header.packed.last_end_lsn));
+	/*
+	 * Where does the 0x40 come from? Is it just usa_offset +
+	 * usa_client * 2 + 7 & ~7 or is it derived from somewhere?
+	 */
+	lr = (LOG_RECORD*)((u8*)rcrd + 0x40);
+	client = 0;
+	do {
+		printf("\nLog record %i:\n", client);
+		dump_log_record(lr);
+		client++;
+		lr = (LOG_RECORD*)((u8*)lr + 0x70);
+	} while (((u8*)lr + 0x70 <= (u8*)rcrd +
+			le64_to_cpu(rcrd->header.packed.next_record_offset)));
+
 	pass++;
 	goto rcrd_pass_loc;
-end_of_rcrd_passes:
+}
+
+/**
+ * main -
+ */
+int main(int argc, char **argv)
+{
+	RESTART_PAGE_HEADER *rstr;
+	RECORD_PAGE_HEADER *rcrd;
+	unsigned int page_size;
+	int buf_size, br, err;
+	logfile_file logfile;
+	u8 *buf;
+
+	printf("\n");
+	if (argc < 2 || argc > 3)
+		/* print usage and exit */
+		usage(argv[0]);
+	/*
+	 * If one argument, it is a device containing an NTFS volume which we
+	 * need to mount and read the $LogFile from so we can dump its
+	 * contents.
+	 *
+	 * If two arguments the first one must be "-f" and the second one is
+	 * the path and name of the $LogFile (or copy thereof) which we need to
+	 * read and dump the contents of.
+	 */
+
+	if (argc == 2) {
+		logfile_open(TRUE, argv[1], &logfile);
+	} else /* if (argc == 3) */ {
+		if (strncmp(argv[1], "-f", strlen("-f")))
+			usage(argv[0]);
+
+		logfile_open(FALSE, argv[2], &logfile);
+	}
+
+	buf_size = 64 * 1024 * 1024;
+
+	if (logfile.data_size <= buf_size)
+		buf_size = logfile.data_size;
+	else
+		Eprintf("Warning: $LogFile is too big.  "
+			"Only analysing the first 64MiB.\n");
+
+	/* For simplicity we read all of $LogFile/$DATA into memory. */
+	buf = malloc(buf_size);
+	if (!buf) {
+		Eprintf("Failed to allocate buffer for file data: %s\n",
+			strerror(errno));
+		logfile_close(&logfile);
+		exit(1);
+	}
+
+	br = logfile_pread(&logfile, 0, buf_size, buf);
+	err = errno;
+	logfile_close(&logfile);
+	if (br != buf_size) {
+		log_err_exit(buf, "Failed to read $LogFile/$DATA: %s\n",
+				br < 0 ? strerror(err) : "Partial read.");
+	}
+
+	/*
+	 * We now have the entirety of the journal ($LogFile/$DATA or argv[2])
+	 * in the memory buffer buf and this has a size of buf_size.  Note we
+	 * apply a size capping at 64MiB, so if the journal is any bigger we
+	 * only have the first 64MiB.  This should not be a problem as I have
+	 * never seen such a large $LogFile.  Usually it is only a few MiB in
+	 * size.
+	 */
+	rstr = (RESTART_PAGE_HEADER*)buf;
+
+	/* Check for presence of restart area signature. */
+	if (!ntfs_is_rstr_record(rstr->magic) &&
+			!ntfs_is_chkd_record(rstr->magic)) {
+		s8 *pos = (s8*)buf;
+		s8 *end = pos + buf_size;
+		while (pos < end && *pos == -1)
+			pos++;
+		if (pos != end)
+			log_err_exit(buf, "$LogFile contents are corrupt "
+					"(magic RSTR is missing).  Cannot "
+					"handle this yet.\n");
+		/* All bytes are -1. */
+		free(buf);
+		puts("$LogFile is not initialized.");
+		return 0;
+	}
+	
+	/*
+	 * First, verify the restart page header for consistency.
+	 */
+	restart_header_sanity(rstr, buf);
+	page_size = le32_to_cpu(rstr->log_page_size);
+
+	/*
+	 * Second, verify the restart area itself.
+	 */
+	// TODO: Implement this.
+	Eprintf("Warning:  Sanity checking of restart area not implemented "
+		"yet.\n");
+	/*
+	 * Third and last, verify the array of log client records.
+	 */
+	// TODO: Implement this.
+	Eprintf("Warning:  Sanity checking of array of log client records not "
+		"implemented yet.\n");
+
+	/*
+	 * Dump the restart headers & areas.
+	 */
+	rcrd = (RECORD_PAGE_HEADER*)dump_restart_areas(rstr, buf, page_size);
+	printf("\n\nFinished with restart pages.  "
+ 		"Beginning with log pages.\n");
+
+	/*
+	 * Dump the log areas.
+	 */
+	dump_log_records(rcrd, buf, buf_size, page_size);
+
 	free(buf);
 	return 0;
 }