Skip to content

UsnJrnl2Csv Hands on Labs

Choose the Interactive Lab to practise in your browser, or the Full Lab to parse a real, authorised journal in Windows. The Interactive Lab repairs an export/import check; the Full Lab applies the tool to real authorised evidence.

Interactive Lab

Browser based

UsnJrnl2Csv Interactive Lab

No installation

The interactive parser requires JavaScript. You can still follow the complete real tool Full Lab below.

Full Lab

Windows lab

UsnJrnl2Csv Full Lab

Real evidence required

Hands on Proof of Concept

Parse it. Follow it. Explain it.

A handover file has disappeared. Turn a preserved journal into a traceable finding, test a misleading name match, and show where the evidence stops.

Start the Full Lab

Outcome led, not screenshot led

The real export will contain your source's timestamps, counts and references. Do not try to reproduce the three synthetic browser records. Preserve unexpected results and explain them.

Before you begin

You need: a Windows analysis VM, UsnJrnl2Csv, an authorised extracted $J stream with acquisition context, a text/CSV viewer, a separate case output location, and preferably a matching $MFT. Allow space for both working data and expanded text output. No database server is required.

How to use this lab

Keep this page open alongside the GUI. Save evidence after every milestone. If you generate your own source data, follow the linked collection exercise and take a VM snapshot first.

Recommended first

Beginner Core Lab

Parse instructor supplied journal data from a known create/rename/delete exercise. Obtain the acquisition notes, ground truth and matching MFT if available. Keep ground truth closed until the first review.

Alternative input route

Generate your own case

Complete Activities 1 and 2 in the ExtractUsnJrnl Full Lab in a disposable VM. It supplies explicit commands for creating the harmless sequence, collecting promptly and verifying a working copy. Return here to parse it.

  1. Session 1Prepare and predict
  2. Session 2Parse and validate
  3. Session 3Follow and report

Objective

Determine whether the retained journal supports a rename and deletion for the same file reference. Distinguish a name match from identity, document one negative control, and retain enough settings and evidence for a second analyst to repeat the review. If the supplied dataset uses different names, record those substitutions before starting.

01

Activity 1: Prepare the case

  1. Follow Install and prepare. Save the tool source, release, executable hash, source volume identity and acquisition times.
  2. Preserve the original binary. Prepare the raw, working, parsed\run-01 and notes folders shown in the guide. Use a fresh case directory if these names are already occupied.
  3. Compare the raw and working copy SHA-256 values and retain the results. If they differ, remake and verify the copy before parsing.
  4. Write your prediction: which names and change reasons would connect a rename and deletion? Record the case time window and UTC offset.
  5. Define handover-never-created.txt as a negative control, or choose an agreed absent name for your dataset. Record why you expect it to be absent.
  6. Record whether matching MFT data is available. If not, explicitly leave parent path resolution as an outstanding check.
Milestone 1Traceable inputOriginal and working copy match; the scope, prediction and control are written down.

Expected result Another analyst can identify the acquisition and recreate the exact parser input.

02

Activity 2: Parse and verify

  1. Launch the GUI. Change Output to parsed\run-01; Browse $UsnJrnl to the working binary.
  2. Follow the first run settings: UTC, format 6, NanoSec, pipe delimiter, Unicode, dump everything, normal mode. Capture all settings and the input/output paths.
  3. Click Start Parsing. Preserve the log and identify the actual output files. Stop to investigate read/decode errors or an empty result.
  4. Open the delimited text, then import a copy with the matching separator. Treat identifiers and timestamps as text; verify one row against the untouched export.
  5. Record row count, first/last observed time, errors, output filename and SHA-256. Retain the original export separately from your filtered working view.
  6. Recheck the working binary's hash after parsing and compare it with the pre run value.
Small experiment: change only displayed precision

Make a second run into parsed\run-02 with precision None. Keep input, timezone, mode and other settings unchanged. Compare the same record identifiers and reason flags. Explain the loss of displayed fractional seconds; do not mistake formatting changes for new activity. Preserve both runs and return to the detailed baseline for analysis.

Milestone 2Usable, reproducible exportSettings, messages, sample row, counts and hashes are retained.

Expected result Your viewer displays meaningful columns and the parser input remains unchanged.

03

Activity 3: Investigate and report

  1. Search the original filename within the documented time window. Record your filter and the matching reference, including its sequence component where applicable.
  2. Clear the filename filter and follow that reference across all names. Sort by recorded time and use USNs for journal ordering/context.
  3. Identify the old and new name pair and any deletion observation. Retain full source rows; extra records or combined flags can be legitimate.
  4. Search the final filename separately. If another reference uses it, keep that identity separate. Do not manufacture a decoy if your real dataset has none.
  5. Resolve the parent through matching MFT data when possible. Record collection time differences and unresolved paths.
  6. Search the negative control with the same scope. Save zero matches or investigate a surprise match.
  7. Open the ground truth notes and compare. If expected rows are missing, assess collection delay, journal retention, input identity and parser support rather than changing the answer to fit the prediction.
  8. Write the case note below and identify the next corroborating evidence source.
Case and question:
Source host / NTFS volume / acquisition times:
Original and working-copy hashes:
Parser version / settings / output path / output hash:
Viewer import options / filters / row counts:
File reference / parent reference / relevant USNs:
Observed names, change reasons and UTC times:
Negative control and ground-truth comparison:
Conclusion / uncertainty / next evidence check:
Milestone 3Finding ready for reviewThe conclusion points to records, distinguishes identities and states what remains unknown.

Expected result You can support or qualify the rename/deletion hypothesis without attributing a person or recovering contents from the journal alone.

Full Lab evidence checklist

Mark an item only after saving the evidence. This checklist applies to the real tool Full Lab; the Interactive Lab has its own downloadable training summary.

0 of 8 recorded Record evidence as you complete each milestone.

Troubleshooting and cleanup

Use the parser troubleshooting table for empty output, shifted times or broken imports. Do not overwrite your baseline while testing a remedy. Preserve the source, exports, hashes and notes; close the parser and restore disposable exercise VMs only after the evidence package is safely retained.

PreviousReview and interpretNextReturn to overview