$Max and $J named data streams under <ROOT>\$Extend\$UsnJrnl

Overview

The Update Sequence Number Journal (USN) Journal is a feature of NTFS, activated by default on Vista and later, which maintains a record of changes made to the NTFS volume. The creation, deletion or modification of files or directories are for instance journalized.

The records in the UsnJrnl are progressively overwritten once the max size of the journal has been reached. The UsnJrnl usually contains historical data on the last few days (1-3 days for system full time use, < 7 days for regular system use).

Information of interest

The UsnJrnl is composed of two named data streams:

  • The $Max stream stores the metadata of the change.

  • The $J stream stores the actual change log records.

Each change log record is notably composed of:

  • an Update Sequence Number (USN).

  • The timestamp of the change.

  • The filename of the file impacted by the change.

  • The reason / operation of the record (USN_REASON_FILE_CREATE, USN_REASON_FILE_DELETE, USN_REASON_DATA_OVERWRITE, USN_REASON_RENAME_NEW_NAME, etc.).

  • MFT reference and reference sequence number.

Tool(s)

UsnJrnl metadata

The Windows fsutil and the PowerShell cmdlet Get-ForensicUsnJrnlInformation of the PowerForensics suite can be used to retrieve metadata about the UsnJrnl:

# First and current USN, maximum size notably
fsutil usn queryjournal <NTFS_VOLUME>

Get-ForensicUsnJrnlInformation
Get-ForensicUsnJrnlInformation -VolumeName <NTFS_VOLUME>
Get-ForensicUsnJrnlInformation -Path <USN_JRNL_PATH>

MFTECmd

The MFTECmd utility can parse and extract information from the UsnJrnl (as well as other NTFS filesystem artefacts such as the MFT’s $J stream, the file ownership $Secure:$SDS data stream, and the transaction log file $Logfile).

Associated KAPE compound module: MFTECmd (includes MFTECmd_$Boot, MFTECmd_$MFT, MFTECmd_$J, and MFTECmd_$SDS).

MFTECmd.exe -f '<UsnJrnl>' --csv <OUTPUTDIR_PATH>

References



View on GitHub