Skip to content

USN Journal as CSV

Evidence: USN Journal as CSV
Description: Parse USN Journal Entries in CSV Format
Category: DiskFilesystem
Platform: windows
Short Name: usncsv
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No

The Update Sequence Number (USN) Journal is an NTFS feature that logs all changes made to files and directories on a volume. Every file system operation (create, delete, modify, rename) generates a USN record.

The USN Journal provides a comprehensive timeline of file system activity and can track changes that occurred before the system acquisition. It’s particularly valuable for detecting file manipulation, identifying deleted files, and reconstructing attacker activity.

This collector gathers structured data about usn journal as csv.

FieldDescriptionExample
FileNameFile or directory namedocument.docx
UpdateSequenceNumberUnique sequence number123456789
UpdateDateTimeWhen the change occurred2023-10-15T14:30:00Z
UpdateReasonFlagsType of changeFILE_CREATE+DATA_EXTEND
MftFileReferenceMFT entry number12345
MftFileReferenceSequenceMFT sequence number1
MftParentFileReferenceParent directory MFT entry5
MftParentFileReferenceSequenceParent sequence number1
FileAttributeFlagsFile attributesREAD_ONLY+ARCHIVE
UpdateSourceFlagsSource of updateDATA_MANAGEMENT

This collector:

  • Reads the USN Journal from all fixed NTFS drives
  • Parses each USN record using NtfsEnumerateUSNEntries
  • Exports records to CSV format
  • Converts reason flags, source flags, and attribute flags to human-readable format

Update Reason Flags include: DATA_OVERWRITE, DATA_EXTEND, FILE_CREATE, FILE_DELETE, RENAME_OLD_NAME, RENAME_NEW_NAME, SECURITY_CHANGE, and many others.

The USN Journal provides unparalleled visibility into file system activity and is essential for timeline reconstruction. Investigators use this data to reconstruct complete file activity timelines, detect mass file deletions or encryption (ransomware), identify file renaming operations, track file modifications by timestamp, detect data staging for exfiltration, identify temporary file usage, and correlate file system changes with other events.