UsnJrnl2Csv¶

What UsnJrnl2Csv does¶

File system change history · Windows GUI and CLI

UsnJrnl2Csv (by Joakim Schicht) converts raw NTFS change journal data into readable CSV so you can analyse file activity and build forensic timelines.

Use journal data acquired from the same volume as the corresponding $MFT, and preserve the original binary artefact. Record the parser version and settings, then correlate reason flags and file references with $MFT records because journal entries alone may not retain a complete path.

From a binary stream to a reliable export¶

01 · PreserveExtracted $JVerified working copy
02 · ParseUsnJrnl2CsvRecorded settings and log
03 · FollowFile referenceNames, reasons and UTC
04 · CorroborateMFT + other logsBounded case note

Keep the source, parser run and selected records connected so another analyst can review the finding.

Good investigation question

Do the exported fields, text encoding and recorded time basis survive import into the next analyst’s tool? Validate that boundary before interpreting file activity.

Keep the conclusion bounded

A matching filename is a lead. It does not identify a person, recover file contents, or prove that a file was copied outside the organisation.

Choose your journey¶

01Install and prepareKeep the original screenshots beside the download and launch instructions. Prepare traceable input.Ready when raw and working copy hashes match.Beginner 02Configure and parseChoose input, output and time settings; validate the resulting export.Ready when a sample row and run log are checked.Beginner 03Validate the exportCheck real field names, import settings and the limits of the recorded changes.Ready when each claim points to a record.Beginner 04Go hands onPractise the supplied GUI in your browser, then operate the real tool in a Windows lab.Finish with a reviewable evidence summary.Two routes · Guided beginner

Know the boundaries¶

Input / outcome	What to do
Extracted `$UsnJrnl:$J` stream	Pass its verified working copy to this parser. A `.bin` extension alone does not establish its contents.
Disk image or live NTFS volume	Acquire the stream first with ExtractUsnJrnl or a validated collection tool.
`$MFT`	Parse separately and use it for identity and directory context. It is not the journal input.
Damaged or carved journal fragments	Treat scan mode results as candidates requiring extra validation; keep them separate from the normal run.
Missing historical rows	Consider journal retention, collection time, parser support and errors before concluding an action never happened.

The project documents support for V2 and V3 journal records, with V4 unsupported. This guide uses the 1.0.0.24 release shown in the supplied screenshots; verify your installed version. Project documentation, reference release.

Verification scope and primary references

Reviewed on 19 September 2026 against the UsnJrnl2Csv 1.0.0.24 source and author's usage notes. Case paths, exercise times and synthetic records are teaching data, not facts about your system. Evidence preservation steps are analyst practice, not functions automatically performed by the tool.

The released x64 parser was also checked with a constructed three record V2 fixture for field names, UTF-8 output, separator/quoting, UTC offsets and precision. This is a limited test, not validation of all record versions or damaged inputs.