UsnJrnl

Windows DFIR notes are no longer maintained on InfoSec-Notes. Updated versions can be found on: artefacts.help.

Overview

The Update Sequence Number Journal (USN) Journal is a feature of NTFS, activated by default on Vista and later, which maintains a record of changes made to the NTFS volume. The creation, deletion or modification of files or directories are for instance journalized.

Similarly to the MFT, entries for deleted files are progressively overwritten in the UsnJrnl.

The journal is located in \$Extend\$UsnJrnl ($Max and $J data streams) but can not be accessed through the Windows explorer as it is a system file.

The journal is composed of the $Max and $J data streams. The $Max data stream stores the meta data of the change and the $J data stream stores the actual change log records.

The change log records are notably composed of:

• an Update Sequence Number (USN)

• the timestamp of the change

• the reason the record was logged (USN_REASON_FILE_CREATE, USN_REASON_FILE_DELETE, USN_REASON_DATA_OVERWRITE, USN_REASON_RENAME_NEW_NAME, etc.)

• MFT reference and reference sequence number

UsnJrnl metadata

The Windows fsutil and the PowerShell cmdlet Get-ForensicUsnJrnlInformation of the PowerForensics suite can be used to retrieve metadata about the UsnJrnl:

# First and current USN, maximum size notably
fsutil usn queryjournal <NTFS_VOLUME>

Get-ForensicUsnJrnlInformation
Get-ForensicUsnJrnlInformation -VolumeName <NTFS_VOLUME>
Get-ForensicUsnJrnlInformation -Path <USN_JRNL_PATH>

UsnJrnl extraction and parsing

MFTECmd

The MFTECmd utility can parse and extract information from the UsnJrnl's $J stream (as well as other filesystem artefacts such as the $MFT, the file ownership $Secure:$SDS data stream, and the transaction log file $Logfile).

# A UsnJrnl's $J file on a mounted partition should be specified.
# For instance, to extract UsnJrnl's $J data from a forensics image, the image should first be mounted and the UsnJrnl's $J file specified as <DRIVER_LETTER>:\$Extend\$J to MFTECmd.exe.

MFTECmd.exe -f '<USNJRN_J$>' --csv <OUTPUTDIR_PATH>

ExtractUsnJrnl / UsnJrnl2Csv

The ExtractUsnJrnl.exe with UsnJrnl2Csv.exe utilities as well as the PowerShell cmdlet Get-ForensicFileRecord of the PowerForensics suite can be used to parse and extract information from the UsnJrnl. The tools below do not support the UsnJrnl's USN_RECORD_V4 format yet.

ExtractUsnJrnl64.exe /DevicePath:<NTFS_VOLUME> [/OutputPath:<FULL_OUTPUT_PATH> | /OutputName:<OUTPUT_FILE>]
ExtractUsnJrnl64.exe /ImageFile:<IMAGE_PATH> [/OutputPath:<FULL_OUTPUT_PATH> | /OutputName:<OUTPUT_FILE>]

# Starts the UsnJrnl2Csv GUI
UsnJrnl2Csv64.exe
  UsnJrnl2Csv64.exe /UsnJrnlFile:<INPUT_USN_JRNL> /OutputPath:<OUTPUT_FOLDER> /TimeZone:"<-12.00 ... 14.00>" /Separator:"<CSV_SEPARATOR>"

# May not work properly on newer Windows operating systems
Get-ForensicUsnJrnl
Get-ForensicUsnJrnl -VolumeName <NTFS_VOLUME>
Get-ForensicUsnJrnl -Path <USN_JRNL_PATH>

---

References

http://forensicinsight.org/wp-content/uploads/2013/07/F-INSIGHT-Advanced-UsnJrnl-Forensics-English.pdf https://countuponsecurity.com/2017/05/25/digital-forensics-ntfs-change-journal/