Skip to content

ExtractUsnJrnl Hands on Labs

Practise collecting a journal in the browser, or create and investigate a harmless file sequence in a disposable Windows VM. Both routes ask the same question: what can the journal tell us about a disappearing handover file?

Choose a lab

Interactive Lab

Browser based

ExtractUsnJrnl Interactive Lab

No installation

The interactive terminal requires JavaScript. You can still follow the complete real tool Full Lab below.

Full Lab

Isolated Windows VM

ExtractUsnJrnl Full Lab

Real evidence required

Hands on Proof of Concept

Collect it. Trace it. Explain it.

A handover file was renamed and removed. Create a known sequence, extract the journal, and compare the evidence with what actually happened.

Start the Full Lab

Outcome led, not screenshot led

Your timestamps, record identifiers, journal size and hashes will differ from the browser lab. Record what your system actually produces. Complete a checkpoint only when you have saved the evidence.

Use a disposable, authorised VM

The commands below deliberately create, rename and delete one harmless test file on the lab VM. Never run the preparation sequence on case evidence. Snapshot the VM first and confirm every path and drive letter.

Before you begin

You need: a disposable Windows VM with NTFS C:, administrator access, ExtractUsnJrnl, UsnJrnl2Csv or another validated parser, a text/CSV viewer, and a separate evidence disk mapped to E:. Allow several GB of free space and check actual journal/output requirements. If your destination has another letter, replace E: consistently.

How to use this lab

Use Command Prompt, keep this page open, and save a case notebook on E:. The core exercise intentionally uses live collection to keep setup accessible; document that limitation. Image based collection is the optional extension.

Recommended first

Beginner Core Lab

One disposable VM, one known file sequence, one live journal collection and a separate parser review.

Optional extension

Repeat from an image

Collect from a verified raw image of the training source, retaining its partition map and acquisition context.

  1. Session 1Prepare and predict
  2. Session 2Extract and preserve
  3. Session 3Parse and report

Objective

In case USN-1042, the case owner asks whether handover-draft.txt was renamed to handover-final.txt and then deleted from the lab volume. You will create the ground truth yourself, hide those notes while reviewing the journal, then compare your findings. Do not infer a person or motive from the journal.

01

Activity 1: Build the environment

Prepare the case and baseline

  1. Snapshot your authorised VM. Record hostname, OS, clock/time zone and both source and destination disk identities.
  2. Follow Install and open. Record the binary version, download source/date and SHA-256. Obtain the parser from its official project and record its version too.
  3. In an elevated Command Prompt, check the source filesystem and journal:
fsutil fsinfo volumeinfo C:
fsutil usn queryjournal C:

If the journal is not active, stop and use a disposable VM with an active journal or instructor supplied training evidence. Do not reset a source journal. Preserve the query output and its time.

  1. Create the case folders on the separate evidence disk. Use a new case directory if these already contain a previous attempt.
mkdir E:\Cases\USN-1042\raw
mkdir E:\Cases\USN-1042\working
mkdir E:\Cases\USN-1042\parsed
mkdir E:\Cases\USN-1042\notes

Create the harmless ground truth

Confirm C:\USN-1042-Lab does not contain pre existing material. Use the following commands only in the disposable VM. Record the displayed local date/time and its UTC offset before and after each action; wait a few seconds between actions so the review is easier.

mkdir C:\USN-1042-Lab
echo %date% %time%
echo Harmless SUSA training note> C:\USN-1042-Lab\handover-draft.txt

echo %date% %time%
ren C:\USN-1042-Lab\handover-draft.txt handover-final.txt

echo %date% %time%
del C:\USN-1042-Lab\handover-final.txt
echo %date% %time%

Save the action times and exact commands in notes\ground-truth.txt. Predict the names and change reasons you expect. Record handover-never-created.txt as a negative control; do not create it. Close the ground truth notes during the first evidence review.

Milestone 1Known sequence readyNTFS source, active journal, separate destination and timed create/rename/delete actions are documented.

Expected result The final file is absent from the folder; your notebook retains what happened and when.

02

Activity 2: Collect and verify

Extract promptly

Record collection start/end times and source C:. Minimise unrelated VM activity; live collection is not a frozen snapshot.

cd /d C:\Tools\JoakimSchichtTools\ExtractUsnJrnl
.\ExtractUsnJrnl64.exe /DevicePath:C: /OutputPath:E:\Cases\USN-1042\raw /OutputName:WIN-LAB01_USN.bin > E:\Cases\USN-1042\notes\extract-log.txt 2>&1
type E:\Cases\USN-1042\notes\extract-log.txt
dir E:\Cases\USN-1042\raw\WIN-LAB01_USN.bin
certutil -hashfile E:\Cases\USN-1042\raw\WIN-LAB01_USN.bin SHA256

Inspect all errors and save the byte count and digest in the notebook. If no valid binary exists, stop here and use the troubleshooting table. A returned prompt or successful hash command does not prove a complete journal.

Preserve and make a working copy

copy /b E:\Cases\USN-1042\raw\WIN-LAB01_USN.bin E:\Cases\USN-1042\working\WIN-LAB01_USN.bin
certutil -hashfile E:\Cases\USN-1042\working\WIN-LAB01_USN.bin SHA256

Compare the full digests; retain both results. Protect the raw output and pass only the working binary to the parser. Do not reuse this output filename for another collection.

Milestone 2Collection is traceableThe command, source, times, console log, binary size and matching raw/working-copy hashes are recorded.

Expected result A nonempty binary is retained, collection errors have been addressed, and the working copy matches the preserved output.

03

Activity 3: Investigate and report

Parse separately

  1. Follow the UsnJrnl2Csv guide. Choose working\WIN-LAB01_USN.bin as the input and the case parsed folder as output.
  2. Record parser version and settings. Use UTC output where supported and record the actual delimiter; the documented UsnJrnl2Csv default is a pipe (|). Start with normal parsing and retain its logs.
  3. Open the derived output with the recorded delimiter. Confirm columns are separated correctly and timestamps are understood. Do not compare this lab's local action times with UTC rows until you have converted them.
  4. Filter broadly for handover-, then compare all matching names, file references, parent references, reasons, USNs and timestamps. Preserve complete matching rows and nearby context.
  5. Look for old and new name rename observations associated with the same file reference, followed by a deletion observation. Reasons can be combined; do not demand exactly one row per command or expect only the four simplified rows from the browser exercise.
  6. Search for handover-never-created.txt. Record your negative control result and the dataset/time scope searched.
  7. Reopen the ground truth notes. Explain agreements, missing observations and timing differences. Corroborate identity/path against MFT evidence if available; otherwise explicitly leave that part unverified.
Instructor checkpoint: the expected rename pair is missing

Check the volume, collection time, filename variants, complete file references, parser logs and record format support. Expand the time window before making a negative finding. Keep the result as inconclusive if you cannot establish coverage; do not invent rows to match the prediction.

Write a bounded finding

Case: USN-1042
Question and authority:
Host/volume identity; time zone:
Tool version, command and collection interval:
Raw binary path, byte count and SHA-256:
Working-copy SHA-256 comparison:
Parser/version/settings; derived output path:
Supporting rows (name, reference, parent, USN, reason, timestamp):
Negative-control search and result:
Comparison with ground truth:
Conclusion and confidence:
Coverage, live-collection and attribution limitations:
Next corroborating source:
Cleanup and retained evidence:

A defensible finding identifies the observed sequence and supporting records. It does not claim that the journal identifies who deleted the file, why they did it, or whether its content left the system.

Milestone 3Finding documentedA second analyst can trace the conclusion through parsed rows to the retained binary and collection context.

Expected result Your case note compares observations with ground truth, includes the negative control and explains any unresolved gaps.

Optional extension: collect from a verified raw image

Acquire the disposable training source using an authorised acquisition workflow. Verify its image hash and identify the NTFS partition before using the image collection route with a fresh output folder. Compare relevant observations with the live result. Do not demand matching binary hashes between sources captured at different times. Record which source and collection each finding belongs to.

Full Lab evidence checklist

These checks apply to your real VM exercise. Browser learners should download their simulation summary instead. Mark each item only after saving its evidence.

0 of 8 recorded Save the evidence, then mark the item.

Troubleshooting and cleanup

Use the collection troubleshooting guide for source or extraction failures. For unexpected parsed results, check volume identity, incident window coverage, parser compatibility and time zone settings before drawing a conclusion.

Copy your retained evidence and notes to controlled storage outside the disposable VM, verify that copy, then restore the baseline snapshot. Do not delete or reset the USN journal as cleanup. Confirm your evidence disk will survive the chosen snapshot/recovery procedure.

PreviousReview and interpret the evidenceNext toolParse the journal