USN Journal
Definition
The NTFS Update Sequence Number journal ($UsnJrnl:$J), a per-volume change log that records create, delete, rename, and metadata-change events. Survives long after the affected files are gone and is the leading source of timestomp detection by cross-checking against $MFT.
- Full path
- $UsnJrnl:$J
- Filesystem
- NTFS
- Records
- Create, delete, rename, metadata-change events
- Scope
- Per-volume change log
- Forensic use
- Timestomp detection via cross-check with $MFT
Common questions
How does the USN journal reveal timestomping when $MFT alone does not?+
The journal records the sequence of change events independently of the $MFT's mutable timestamp fields, so an examiner compares the journal's event order against the $MFT timestamps and any mismatch signals that timestamps were altered after the fact.
Why does journal data outlast the files it describes?+
The journal is a separate circular log file that keeps appending change records until it is full and begins overwriting the oldest entries, so records for a deleted file can persist in the journal long after the file itself and its $MFT entry are gone.
Related terms
- Anti-Forensics
- Any deliberate technique used to hinder, mislead, or defeat forensic examination. The term was coined in the late 1990s by US incident...
- Cold-Boot Attack
- An attack on full-disk encryption that exploits the fact that DRAM contents fade gradually after power-off. With the chips cooled to roughly...
- Steganography
- Concealing one file inside another in a way that hides the existence of the hidden file. LSB image manipulation, JPEG DCT coefficient...
- Timestomping
- Falsification of file system timestamps to mislead a timeline analysis. The Metasploit tool timestomp.exe and the open-source SetMACE are the canonical references....
- VeraCrypt Hidden Volume
- A second, encrypted volume nested inside the free space of a primary VeraCrypt volume. Either password unlocks one of the two volumes;...