USN Journal / $UsnJrnl

Location & availability

NTFS volume metadata: $Extend\$UsnJrnl:$J

The journal is bounded and can wrap. Its presence, identifier and retained range are volume-specific.

Fields to examine

• File reference number and parent reference; preserve sequence context.
• USN, record timestamp and reason flags.
• Recorded filename; a full historical path may require reconstruction.

What it can establish

• Support recorded file/directory changes and a sequence within retained journal coverage.
• Connect old/new rename records when file identity and context agree.

What it cannot prove

• Prove file execution, identify the responsible process or recover complete file contents.
• Treat BASIC_INFO_CHANGE as automatic proof of malicious timestamp manipulation.

Use it in a screenshare

1. Identify the correct volume. Acquire the journal and useful MFT context before running broad searches that change the live system.
2. Parse a copy and inspect reason flags, file references and parent references together. Pair rename events rather than joining on filename alone.
3. Build a scoped sequence and compare it with file identity, browser downloads and independent execution records. Document journal wrap or unresolved paths.

Worked example

Records show a file created as update.exe, renamed to helper.exe and later deleted. That supports a file-change sequence. To claim the file ran, add Prefetch or a process event; the journal itself does not supply that evidence.

Cross-check the finding

• $MFT →Support the presence and recorded metadata of a particular file record.
• NTFS $LogFile →Support particular filesystem metadata operations in retained transaction records.
• Prefetch →Support execution of an associated executable within the retained history.
• Browser download records →Support a recorded transfer attempt and, when recorded, its completion state.

Sources

• Microsoft — USN change records ↗
• Microsoft — change journals ↗