USN journal

The NTFS Update Sequence Number journal ($UsnJrnl:$J), a per-volume change log that records create, delete, rename, and metadata-change events. Survives long after the affected files are gone and is the leading source of timestomp detection by cross-checking against $MFT.

Explained in

Anti-Forensic Techniques and Investigator Counter-Methods

Your journey to becoming a forensic professional starts here.

Practice with mock tests, learn from structured notes, and get your questions answered by a global forensic community, all in one place.

Continue learning Create Your Account

USN journal

Explained in

Related terms

Your journey to becoming a forensic professional starts here.