01Location
- <NTFS volume>\$Extend\$UsnJrnl:$J
- <NTFS volume>\$Extend\$UsnJrnl:$Max
02Questions it answers
- When was a file created, renamed, overwritten, extended, truncated or deleted?
- What were the old and new names of a renamed file?
- In which directory did a file reside (parent reference)?
- Which files existed briefly and are no longer present in $MFT?
03Format and versions
| Format | $J is a sparse stream of 64-bit aligned USN_RECORD_V2 entries (major version 2) stored per block; $Max is 32 bytes of metadata (maximum size, allocation delta, journal identifier as FILETIME). |
|---|---|
| Applies to | NTFS volumes with an active change journal; the MFT entry index of $UsnJrnl is not fixed. |
04Key fields
| Field | What it tells you |
|---|---|
| FileReferenceNumber | MFT reference of the changed file or directory. |
| ParentFileReferenceNumber | MFT reference of the containing directory. |
| Usn | Offset of the record in $J, used as a unique identifier. |
| Reason | Accumulated change flags since the file was opened, e.g. FILE_CREATE, FILE_DELETE, RENAME_OLD_NAME, RENAME_NEW_NAME, DATA_OVERWRITE, STREAM_CHANGE, CLOSE. |
| SourceInfo | Flags such as DATA_MANAGEMENT, AUXILIARY_DATA and REPLICATION_MANAGEMENT. |
| FileName / FileAttributes / SecurityId | Name (UTF-16LE), attribute flags and $Secure identifier at the time of the record. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| TimeStamp | FILETIME (UTC) | Time of the journal record. |
| $Max journal identifier | FILETIME (UTC) | Identifies the journal instance. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Extract $UsnJrnl:$J and $Max; skip sparse ranges rather than treating them as data.
- Parse records and resolve file and parent references against $MFT, checking sequence numbers.
- Group records per file reference up to USN_REASON_CLOSE to reconstruct each operation.
- Combine with $MFT, $LogFile and Volume Shadow Copies to extend coverage.
07Interpretation pitfalls
- The journal describes changes and names; it does not contain the changed data.
- When the stream reaches its maximum size the oldest records are removed and replaced by a sparse range.
- Records hold only the file name; full paths depend on resolving parent references, which may point to reused MFT entries.
09Sources
- New Technologies File System (NTFS) libyal / libfsntfs (J. Metz) · checked 2026-10-14
- Change Journals Microsoft Learn · checked 2026-10-14
- USN_RECORD_V2 structure (winioctl.h) Microsoft Learn · checked 2026-10-14
- MFTECmd README Eric Zimmerman (GitHub) · checked 2026-10-14