Review and interpret the evidence¶
Journey 03
Extraction is complete. Now turn a verified working copy into records and answer a specific question: was the handover file renamed and then deleted? Keep the original binary and the parser's derived output separate.
Hand off to a parser¶
Open the working binary with UsnJrnl2Csv or another validated journal parser. For UsnJrnl2Csv, choose the extracted $J file, a separate parsed output directory, and a documented time zone setting (UTC is useful for cross source comparison). Start with normal parsing, then review the parser log and output columns. The supported version statement below is the author’s documented claim, not a validation of every record type in this review. Its documentation describes V2/V3 support and warns that V4 is unsupported; record any coverage limitation.
- Inspect the sequence
Filter for the target filename and renamed variants. Retain nearby rows, reasons, timestamps, USNs, file references and parent references. - Correlate identity
Compare file reference and sequence information where available. A filename match alone does not establish that two records concern the same file. - Keep time explicit
Record the parser's time basis and preserve original timestamp values. Do not silently mix UTC and local time. - Bound the finding
Seek corroboration in the MFT, relevant event logs or other evidence. Journal observations alone do not identify an actor, prove intent, recover file contents or prove exfiltration.
Analyst checkpoint: extraction succeeded, but there is no CSV. What next?
That is expected: ExtractUsnJrnl produces a binary for separate parsing. Verify and retain it, copy it to your working folder, and pass that copy to a journal parser. Renaming .bin to .csv does not convert the data.
Apply it to a DFIR case¶
The following is a synthetic teaching example, not a promised result from your own evidence. The combined record:sequence notation is teaching shorthand; UsnJrnl2Csv’s dump everything export uses separate reference and sequence columns and joins combined reasons with +. The case concerns handover-draft.txt on WIN-LAB01 during 10:10 to 10:20 UTC.
| Observation | What to compare | What it can support |
|---|---|---|
Old name record: handover-draft.txt |
File reference, parent reference, USN and time | A recorded old name for the referenced file. |
New name record: handover-final.txt |
The same file reference, surrounding sequence and parent context | A rename interpretation when the records and context agree. |
Deletion reason for handover-final.txt |
Matching reference and later position in the sequence | A deletion observation for that referenced file. |
Another handover-final.txt with a different reference |
Distinguish this object from the first file | A matching name alone cannot connect the records. |
A defensible case note
“The reviewed excerpt contains old name, new name and deletion observations for reference 28432:3. This supports a rename/delete sequence within the reviewed dataset. Attribution, historical path and journal coverage need corroboration.”
Include the actual rows, source identity, tool/parser versions, collection interval, binary hash and parser time basis with your own finding.
Test the explanation¶
Positive and negative checks
Search both names and a broader filename stem, then compare complete references and surrounding records. Search a deliberately absent control name and record the dataset searched. A negative result describes that search, not every activity that ever occurred on the volume.
Independent corroboration
Use the MFT to investigate identity and parent context, and relevant endpoint logs to investigate activity and attribution. If corroborating evidence is unavailable, retain the finding with that limitation rather than filling in the gap.
Practise the complete workflow¶
In the Interactive Lab, type ExtractUsnJrnl commands in a simulated Command Prompt to collect the authorised image's journal. Inspect and hash the result before reviewing a separately prepared parser excerpt. The Full Lab repeats the investigation with a harmless sequence you create in a disposable VM.
Verification scope and primary references
Reviewed on 19 September 2026 against the ExtractUsnJrnl 1.0.0.5 source and author's usage notes. Case paths, exercise times and synthetic records are teaching data, not facts about your system. Evidence preservation steps are analyst practice, not functions automatically performed by the tool.
Extraction commands and source modes were checked against the source and usage notes. Live volume, image and shadow copy acquisition were not executed during this review; test the installed build with known input before casework.