Install and prepare ExtractUsnJrnl¶
Journey 01
Prepare your Command Prompt, inspect the supplied help screen, and learn which switches select the source and destination. Finish with: a recorded tool version and a source selection plan.
Accessing ExtractUsnJrnl in SUSA¶
Prefer extraction from a verified image. If live collection is necessary, record the command, source volume, collection time and changes made to the system; hash the output and keep an unchanged copy before parsing it.
Open a command prompt and navigate to C:\Tools\JoakimSchichtTools\.
Clone the GitHub repository by running:
If the folder already exists, inspect the installed version and provenance before replacing it. Record the download source, date and binary hash in your case notes.
In C:\Tools\JoakimSchichtTools\ExtractUsnJrnl, run ExtractUsnJrnl64.exe to verify the installation.
Read the help screen as a source selection menu
The supplied screenshot shows version 1.0.0.5. Launching without arguments displays syntax; it has not collected evidence. The examples below use Command Prompt (cmd.exe). Record the help and version actually installed. Use an elevated prompt for authorised raw device access.
Decode the switches¶
| Switch | Decision you make | Example |
|---|---|---|
/ImageFile: |
Which raw disk or partition image? | /ImageFile:D:\Evidence\disk.dd |
/ImageVolume: |
Which volume within that image? Confirm the mapping first. | /ImageVolume:1 |
/DevicePath: |
Which accessible volume or device? Alternative to ImageFile. | /DevicePath:C: |
/OutputPath: |
Where will the extracted evidence go? | /OutputPath:E:\Cases\USN-1042\raw |
/OutputName: |
How will this collection be identified? | /OutputName:WIN-LAB01_USN.bin |
The upstream usage reference specifies raw dd style image input and requires a volume number with image input (also with physical drive input). Do not pass an E01 container directly. Use a verified raw working image instead. Read only mounts are not guaranteed to work with this build: its source requests broad access rights on some input handles. Do not weaken protection of original evidence to satisfy a tool; test a disposable working copy and retain the original. Always set an explicit destination and filename rather than relying on defaults. Create the destination first: _GetInputParams falls back to the program directory when the supplied output path does not exist. Check the actual output location after the run.
Ready to collect?¶
- Tool ready
The executable opens and its help/version are recorded. - Source identified
You know which authorised image or volume you will examine. - Destination separate
The collection will be written to a case folder away from the source.
Verification scope and primary references
Reviewed on 19 September 2026 against the ExtractUsnJrnl 1.0.0.5 source and author's usage notes. Case paths, exercise times and synthetic records are teaching data, not facts about your system. Evidence preservation steps are analyst practice, not functions automatically performed by the tool.
Extraction commands and source modes were checked against the source and usage notes. Live volume, image and shadow copy acquisition were not executed during this review; test the installed build with known input before casework.