• NTDS.DIT
• EDB.LOG
• EDB.Che
• Res1.log and Res2.log

All AD changes didn’t write DIRECTLY to NTDS.DIT database FILE, first write to EDB.Log and from log file to database, EDB.Che used to track the database UPDATE from log file, to know what changes are copied to database file.

NTDS.DIT: NTDS.DIT is the AD database and store all AD objects, Default location is the %system root%nrdsnrds.dit, Active Directory database engine is the extensible storage engine which us based on the Jet database

EDB.Log: EDB.Log is the transaction log file when EDB.Log is full, it is renamed to EDB Num.log where num is the increasing number starting from 1, like EDB1.Log

EDB.Che: EDB.Che is the checkpoint file used to trace the data not yet written to database file this indicate the starting point from which data is to be recovered from the log file in case if failure

Res1.log and Res2.log: RES is reserved transaction log file which provide the transaction log file enough time to shutdown if the disk didn’t have enough space.

All AD changes didn’t write directly to NTDS.DIT database file, first write to EDB.Log and from log file to database, EDB.Che used to track the database update from log file, to know what changes are copied to database file.

NTDS.DIT: NTDS.DIT is the AD database and store all AD objects, Default location is the %system root%nrdsnrds.dit, Active Directory database engine is the extensible storage engine which us based on the Jet database

EDB.Log: EDB.Log is the transaction log file when EDB.Log is full, it is renamed to EDB Num.log where num is the increasing number starting from 1, like EDB1.Log

EDB.Che: EDB.Che is the checkpoint file used to trace the data not yet written to database file this indicate the starting point from which data is to be recovered from the log file in case if failure

Res1.log and Res2.log: Res is reserved transaction log file which provide the transaction log file enough time to shutdown if the disk didn’t have enough space.