USN Journal
Definition
The NTFS Update Sequence Number journal ($UsnJrnl:$J), a per-volume change log that records create, delete, rename, and metadata-change events. Survives long after the affected files are gone and is the leading source of timestomp detection by cross-checking against $MFT.
Related terms
- Anti-Forensics
- Any deliberate technique used to hinder, mislead, or defeat forensic examination. The term was coined in the late 1990s by US incident...
- Cold-Boot Attack
- An attack on full-disk encryption that exploits the fact that DRAM contents fade gradually after power-off. With the chips cooled to roughly...
- Steganography
- Concealing one file inside another in a way that hides the existence of the hidden file. LSB image manipulation, JPEG DCT coefficient...
- Timestomping
- Falsification of file system timestamps to mislead a timeline analysis. The Metasploit tool timestomp.exe and the open-source SetMACE are the canonical references....
- VeraCrypt Hidden Volume
- A second, encrypted volume nested inside the free space of a primary VeraCrypt volume. Either password unlocks one of the two volumes;...
Explained in
- Anti-Forensic Techniques and Investigator Counter-MethodsThe NTFS Update Sequence Number journal ($UsnJrnl:$J), a per-volume change log that records create, delete, rename, and metadata-change events. Survives long a...