UsnJrnl
Last updated
Last updated
Windows DFIR notes are no longer maintained on InfoSec-Notes. Updated versions can be found on: .
The Update Sequence Number Journal (USN) Journal is a feature of NTFS, activated by default on Vista and later, which maintains a record of changes made to the NTFS volume. The creation, deletion or modification of files or directories are for instance journalized.
Similarly to the MFT, entries for deleted files are progressively overwritten in the UsnJrnl.
The journal is located in \$Extend\$UsnJrnl ($Max and $J data streams) but can not be accessed through the Windows explorer as it is a system file.
The journal is composed of the $Max and $J data streams. The $Max data stream stores the meta data of the change and the $J data stream stores the actual change log records.
The change log records are notably composed of:
an Update Sequence Number (USN)
the timestamp of the change
the reason the record was logged (USN_REASON_FILE_CREATE, USN_REASON_FILE_DELETE, USN_REASON_DATA_OVERWRITE, USN_REASON_RENAME_NEW_NAME, etc.)
MFT reference and reference sequence number
The Windows fsutil and the PowerShell cmdlet Get-ForensicUsnJrnlInformation of the PowerForensics suite can be used to retrieve metadata about the UsnJrnl:
MFTECmd
The MFTECmd utility can parse and extract information from the UsnJrnl's $J stream (as well as other filesystem artefacts such as the $MFT, the file ownership $Secure:$SDS data stream, and the transaction log file $Logfile).
ExtractUsnJrnl / UsnJrnl2Csv
The ExtractUsnJrnl.exe with UsnJrnl2Csv.exe utilities as well as the PowerShell cmdlet Get-ForensicFileRecord of the PowerForensics suite can be used to parse and extract information from the UsnJrnl. The tools below do not support the UsnJrnl's USN_RECORD_V4 format yet.
http://forensicinsight.org/wp-content/uploads/2013/07/F-INSIGHT-Advanced-UsnJrnl-Forensics-English.pdf https://countuponsecurity.com/2017/05/25/digital-forensics-ntfs-change-journal/