ExtractUsnJrnl¶
What ExtractUsnJrnl does¶
NTFS evidence collection
ExtractUsnJrnl (by Joakim Schicht) is a DFIR utility used to extract the NTFS USN Change Journal ($UsnJrnl) from a live system or disk image so it can be analysed with other tools.
Your outcome: collect a traceable journal, preserve its integrity, and prepare a working copy for analysis. The tool extracts binary evidence; a separate parser turns it into readable records.
- Collect
Read journal data from the selected NTFS source. - Preserve
Keep the binary, command, source identity, collection times, logs and hash together. - Interpret
Use a parser, compare related records, and corroborate important findings.
Follow the evidence¶
A document disappeared. What survives?
Follow a Windows journal from the affected volume to a reviewable finding. Select a stage to see the evidence and the analyst's next decision.
Volume 2 / Windows / NTFSTraining case: verified raw working imageCollect from the affected volume.
Check the image identity and partition map. The EFI partition and the analyst workstation are not the source authorised for this case.
Prepare the tool and source →NTFS source → journal binaryExplicit source, volume and output pathPreserve the journal for analysis.
Run an image based extraction to a separate case folder. Retain the command and console log; launching the help screen is not a collection.
Follow the extraction workflow →Log + byte count + SHA-256Preserved output → verified working copyMake the evidence traceable.
Inspect errors and output size, record the digest and verify a working copy. A matching copy hash checks integrity; it does not establish journal completeness.
Verify the binary →Name + reference + reason + timeParsed observations + independent contextExplain only what the records support.
Use a separate parser, compare file references across both names and investigate the deletion observation. Corroborate identity and activity before attributing an actor.
Review and interpret the evidence →THE ARTEFACT
A history of filesystem changes¶
When a change journal is active, NTFS records file and directory changes in a per volume journal. Use the names and change records to investigate an incident window. Microsoft's journal overview.
THE EXTRACTION
Keep the useful data and its source¶
The relevant stream is $Extend\$UsnJrnl:$J. ExtractUsnJrnl omits sparse regions instead of expanding them into a large zero filled file. Retain the source image with this derived binary. Because sparse regions are omitted, byte offsets in the extracted file need not match offsets in the original logical stream; retain the USN and acquisition context. Author's documentation.
Choose your journey¶
01Install and prepareOpen Command Prompt, inspect the supplied screenshots and understand source selection switches.Finish with the tool and evidence boundary ready.Beginner 02Collect and verifyExtract from an image, live volume or shadow copy, then preserve a verified working binary.Finish with a traceable collection.Guided workflow 03Review and interpretHand off to a parser, correlate rename/delete observations and write a finding that explains the evidence and its limits.Finish with an evidence backed explanation.Analyst workflow 04Hands on labsType commands in a browser Command Prompt or investigate real journal evidence in your VM.Choose Interactive Lab or Full Lab.DFIR case · Two practical routes
Verification scope and primary references
Reviewed on 19 September 2026 against the ExtractUsnJrnl 1.0.0.5 source and author's usage notes. Case paths, exercise times and synthetic records are teaching data, not facts about your system. Evidence preservation steps are analyst practice, not functions automatically performed by the tool.
Extraction commands and source modes were checked against the source and usage notes. Live volume, image and shadow copy acquisition were not executed during this review; test the installed build with known input before casework.