NTFS Change Journal ($UsnJrnl:$J)
| Format | NTFS Change Journal ($UsnJrnl:$J) |
|---|---|
| Short name | $UsnJrnl |
| Category | log |
| Platforms | Windows |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
The update sequence number journal in the $J stream of $Extend\$UsnJrnl: one record per change with file reference, parent reference, timestamp, reason flags (create, rename, delete, data overwrite …) and file name. Records are version 2 by default; version 3 (128-bit file IDs, ReFS, or NTFS with range tracking) and version 4 also occur. It often reaches back days or weeks and names files that no longer exist. The stream is sparse; only its end holds records.
Signatures
None recorded
Known extensions
None recorded
References
- USN_RECORD_V2 structure (Microsoft) https://learn.microsoft.com/en-us/windows/win32/api/winioctl/ns-winioctl-usn_record_v2
- USN_RECORD_V3 structure — 128-bit file IDs, range tracking (Microsoft) https://learn.microsoft.com/en-us/windows/win32/api/winioctl/ns-winioctl-usn_record_v3
- New Technologies File System (NTFS) — format documentation, USN change journal (libyal/libfsntfs) https://github.com/libyal/libfsntfs/blob/main/documentation/New%20Technologies%20File%20System%20(NTFS).asciidoc
Cite this entry
Crush Format Reference, “NTFS Change Journal ($UsnJrnl:$J)”. https://kalink0.github.io/crush-forensics/formats/usnjrnl/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction