$UsnJrnl (USN Change Journal)

Location

Common Names

Description

NTFS Update Sequence Number journal logging every file system change including creates, deletes, renames, data overwrites, and security descriptor changes.

Forensic Value

The USN journal captures a chronological record of every filesystem change, providing a high-fidelity timeline even for files that have been deleted. Rename chains expose attacker attempts to disguise malicious binaries (e.g., renaming svchost.exe to a temp path). Rapid bulk deletes indicate evidence destruction or ransomware encryption.

Tools Required

Collection Commands

kape.exe --tsource C: --tdest C:\output --target NTFS

MFTECmd.exe -f "C:\$Extend\$UsnJrnl:$J" --csv C:\output --csvf UsnJrnl.csv

ExtractUsnJrnl.exe /DevicePath:C: /OutputPath:C:\output

Load $UsnJrnl:$J in NTFS Log Tracker for timeline analysis

Collection Constraints

• •Availability, retention, and field coverage depend on the Windows release, SKU, per-host audit policy, and user activity. Treat absence as inconclusive unless you verified the feature was enabled.

MITRE ATT&CK Techniques

References