Skip to content

Glossary

USN journal ($UsnJrnl:$J)

The NTFS change journal: one dated record per file change with reason flags, file reference and name, usually covering days to weeks.

The USN (update sequence number) change journal is stored in the $J data stream of $Extend\$UsnJrnl. Windows adds a record each time a file or folder changes: a timestamp, reason flags such as FILE_CREATE, RENAME_NEW_NAME or BASIC_INFO_CHANGE, the file and parent MFT references and the name. Applications like backup and search use it through the change journal API.

It usually reaches much further back than $LogFile but records only that something changed, not the old and new values. It can also be deleted by an administrator. The two are complementary: see $LogFile vs $UsnJrnl vs $MFT, and parse $J with the USN journal parser.