Configure and parse a journal¶
Your first normal parse¶
Question → settings → export → verification
You have a verified working $J stream. Your first run should make its records easy to inspect without changing the preserved binary. Keep a settings note beside the output, then repeat only when you can explain what the changed setting is testing.
1. Choose the destination and source¶
Click Change Output and select a new folder such as E:\Cases\USN-1042\parsed\run-01. Confirm the path in the log area. Click Browse $UsnJrnl and select working\WIN-LAB01_USN.bin. Check the full input path, not just the filename.
2. Set the baseline¶
| Control in the supplied GUI | First run choice | Reason for this exercise |
|---|---|---|
| Timestamp format / Precision | 6 / NanoSec |
Keep a consistent, detailed timestamp display; check the preview. Displayed precision is not proof of clock accuracy. |
| Region | UTC 0.00 |
Compare directly with the case's UTC window. |
| Separator / Quotation mark | Pipe | / off |
Record these choices and use the same delimiter when importing. “CSV” does not necessarily mean comma separated. |
| Unicode | On | This release writes UTF-8 (with a BOM); off uses the Windows ANSI code page. Import using the matching encoding. |
| Output format | dump everything | Keep a broad field set for the first evidence review. |
| Scan mode | Off | Begin with the structured, extracted stream supplied for this case. |
The GUI initially has no output format selected, unlike the command line default of all. Choose one explicitly; this release clears the format radio buttons after parsing, so select it again before a second run.
Leave page size 4096, offset 0, precision separators and timestamp error value at their shown defaults for this first run. Record any departure from this baseline and the reason. The real GUI's labels and flow are documented in the upstream implementation.
3. Parse and inspect the run¶
Click Start Parsing. Preserve the displayed messages and output folder listing. The run log records the input byte count and entries parsed; retain it with the GUI messages. Investigate errors before continuing; an output file can exist even when the run is incomplete.
Version 1.0.0.24 names its output UsnJrnl_<run timestamp>.csv, with corresponding .log and SQL import script files. The timestamp in the filename describes the run, not an event.
Open the actual generated delimited file in a text viewer first. Retain its exact filename and headers rather than assuming the filename used by the training viewer. Then import a copy into your CSV viewer with the recorded separator. Import references and USNs as text to avoid rounding large integers; preserve full timestamps as text too.
Check the boundary before analysis
- Verify that headers split into columns, rather than one long field.
- Check a timestamp, name, file reference, parent reference and reason against the raw export.
- Record data rows and logged errors; the log is not a complete ledger of every skipped candidate. Preserve it rather than inventing a rejected row count.
- Hash the retained export and save the settings and run log beside it.
When another mode is appropriate¶
Timeline interchange
The GUI also offers log2timeline and bodyfile. Choose one only after checking the receiving tool's import requirements and which fields will be retained. Keep the baseline export for comparison.
Damaged input
Scan mode is intended for damaged or carved data. Filename and timestamp validation help screen candidates in that mode. Preserve a separate run and compare questionable records; extra rows are not automatically extra reliable evidence.
With a comma separator, enable Quotation mark if a filename contains a comma and use a quote aware importer. A delimiter inside an unquoted field can shift the remaining columns.
See the project's mode and switch reference. Do not enable scan mode merely to make an empty result look successful.
Repeat through the command line¶
After validating the GUI result, you can record a repeatable invocation. In Command Prompt, change to your installation directory, create a fresh run-02 folder and use the installed executable name:
UsnJrnl2Csv64.exe /UsnJrnlFile:E:\Cases\USN-1042\working\WIN-LAB01_USN.bin /OutputPath:E:\Cases\USN-1042\parsed\run-02 /OutputFormat:all /TimeZone:0.00 /TSFormat:6 /TSPrecision:NanoSec /Unicode:1 /ScanMode:0
This command line combination was exercised against the released x64 executable with a synthetic V2 stream. It uses paths without spaces and leaves unspecified switches at their defaults. Verify accepted switches against the installed release before adapting it. Compare meaningful fields and counts with the GUI run, not just output filenames.
Troubleshooting¶
| Symptom | Investigate before rerunning |
|---|---|
| No records | Wrong source (MFT/image instead of extracted $J), empty/truncated input, unsupported record version, or processing errors. |
| Everything imports into one column | Delimiter mismatch; import explicitly with the recorded pipe separator. |
| Times appear shifted | Parser region setting, case UTC conversion, and viewer interpretation. |
| References change in a spreadsheet | Automatic numeric conversion; reimport the untouched export as text. |
| Output appears in the tool folder | Change Output was not applied; verify the logged destination. |
| Names or timestamps look implausible | Check encoding, raw rows, source provenance and whether scan mode introduced candidate false positives. |
Verification scope and primary references
Reviewed on 19 September 2026 against the UsnJrnl2Csv 1.0.0.24 source and author's usage notes. Case paths, exercise times and synthetic records are teaching data, not facts about your system. Evidence preservation steps are analyst practice, not functions automatically performed by the tool.
The released x64 parser was also checked with a constructed three record V2 fixture for field names, UTF-8 output, separator/quoting, UTC offsets and precision. This is a limited test, not validation of all record versions or damaged inputs.