USN Journal
Overview
Section titled “Overview”Evidence: USN Journal
Description: Dump Allocated Contents of $UsnJrnl:$J
Category: DiskFilesystem
Platform: windows
Short Name: usnjrn
Is Parsed: No
Sent to Investigation Hub: Yes
Collect File(s): Yes
Background
Section titled “Background”The Update Sequence Number (USN) Journal is a feature of NTFS that provides a persistent log of all changes made to files on the volume. Each file change is assigned a unique USN and recorded with metadata including the type of change, filename, and timestamp. The journal is stored in the $UsnJrnl:$J alternate data stream.
$J is a sparse stream by design. As the journal grows, NTFS trims the oldest records at the head and deallocates those clusters. Only the tail — the newest records that still exist — remains physically allocated. The logical size of $J grows monotonically, while the real on-disk data is only that allocated tail.
Data Collected
Section titled “Data Collected”This collector gathers structured data about the collected USN Journal dump.
USN Journal Data
Section titled “USN Journal Data”| Field | Description | Example |
|---|---|---|
Type | File type | UsnJournal |
Name | File name | $UsnJrnl:$J |
SourcePath | Original path | C:$Extend$UsnJrnl:$J |
FilePath | Path in evidence | NTFSFiles/$UsnJrnl_$J |
FileSize | Allocated size of the collected dump, in bytes | 33554432 |
Collection Method
Section titled “Collection Method”This collector uses kernel driver NTFS raw access to read $UsnJrnl:$J from each fixed NTFS drive. It collects only the allocated (non-sparse) ranges of the stream and writes a compact allocated-only dump. Sparse holes are not read.
That is the complete journal that still exists on disk. Sparse regions are not skipped journal records: those clusters have already been returned to the volume’s free space, and reading them yields zeros synthesized by the filesystem. Windows’ own journal API (FSCTL_READ_USN_JOURNAL) also returns only records that still exist.
Collecting the full logical size would therefore add no forensic value. On some hosts it is also impossible: the logical size of $J can exceed disk capacity (for example 1.8 TB logical on a 255 GB disk). Even a typical 3.5 GB logical $J may contain only tens of megabytes of allocated data, with the rest zeros.
Sparse Collection and Offsets
Section titled “Sparse Collection and Offsets”In the live $J stream, a record’s USN value equals that record’s byte offset. The collected dump concatenates allocated ranges back-to-back, so byte offsets in the output file are compacted and no longer match the original USN values.
This does not drop records. Every USN_RECORD carries its own Usn field, so well-written parsers remain correct. Tools that assume offset == USN in the collected file must use the embedded Usn value instead.
The SHA-256 hash verifies the collected allocated-only dump. It will not match a hash of a full logical copy that includes filesystem-synthesized zeros. Compare hashes only between artifacts produced the same way. $J is also a live stream and can change during collection.
Forensic Value
Section titled “Forensic Value”The USN Journal provides a comprehensive timeline of file system activity including file creation, deletion, modification, and renaming. It can reveal deleted files, track file movements, and establish detailed user activity timelines. Particularly valuable for detecting data exfiltration, tracking malware activity, and reconstructing user actions over extended periods.
Records that have already been trimmed from $J are not in the file anymore. Recovering them requires different techniques, such as unallocated-space carving for USN record signatures or Volume Shadow Copies that may hold older copies of $J. Those are separate capabilities; they cannot be obtained by reading the full logical size of $J.