Install and prepare UsnJrnl2Csv¶

Accessing UsnJrnl2Csv in SUSA¶

In C:\Tools, create a folder named JoakimSchichtTools.

Download UsnJrnl2Csv and extract the contents to C:\Tools\JoakimSchichtTools\UsnJrnlCsv.

Double click UsnJrnl2Csv64.exe (shown as UsnJrnl2Csv64 when extensions are hidden) to launch the application without arguments. The released archive contains both x86 and x64 executables.

The instructions above retain the original folder spelling, UsnJrnlCsv. The GUI screenshot shows UsnJrnl2Csv instead. Either folder name works; use the actual installed path consistently. The screenshot's program directory is not the recommended case output destination.

Prepare a reproducible case¶

Input provenance

Retain the source host, NTFS volume identity, acquisition tool/version, collection times, byte count and original hash. Obtain the matching $MFT when available; record its acquisition time separately.

Output separation

Use a new output folder for each parser run. Keep source binaries, working copies, parser outputs and notes in different folders so a rerun cannot silently replace your baseline.

Suggested case layout (replace E: with your evidence destination):

E:\Cases\USN-1042\
  raw\WIN-LAB01_USN.bin       preserved collection
  working\WIN-LAB01_USN.bin   parser input
  parsed\run-01\             first parser output
  notes\                     hashes, settings, logs, findings

Use PowerShell to compare a provided raw binary with its working copy. Create these folders and copy the supplied binary first; do not point these paths at a live system stream.

Get-FileHash -LiteralPath 'E:\Cases\USN-1042\raw\WIN-LAB01_USN.bin' -Algorithm SHA256
Get-FileHash -LiteralPath 'E:\Cases\USN-1042\working\WIN-LAB01_USN.bin' -Algorithm SHA256

Compare the entire digest, save both results, and stop if they differ. A matching hash establishes copy consistency, not completeness of the journal. Record the parser executable's SHA-256 and version as well.

Ready to parseKnown input, separate outputYou can identify the source volume, explain how the $J stream was collected, and reproduce the working copy.

If you do not have a journal¶

Start with the Interactive Lab, which supplies synthetic records. For the real tool, use the Full Lab with an instructor supplied acquisition or generate a controlled sequence through the linked ExtractUsnJrnl exercise. The browser simulation does not create a binary journal suitable for the real parser. Its CSV-2048 exercise is about fixing delimiter, encoding and time basis problems; the Full Lab below uses real authorised input.

Verification scope and primary references

Reviewed on 19 September 2026 against the UsnJrnl2Csv 1.0.0.24 source and author's usage notes. Case paths, exercise times and synthetic records are teaching data, not facts about your system. Evidence preservation steps are analyst practice, not functions automatically performed by the tool.

The released x64 parser was also checked with a constructed three record V2 fixture for field names, UTF-8 output, separator/quoting, UTC offsets and precision. This is a limited test, not validation of all record versions or damaged inputs.