Skip to content

Review and interpret journal records

Validate the export before interpreting it

An export can be syntactically valid yet displayed incorrectly by the next tool. Start with separator, encoding, time basis and field preservation. A one column import is not proof of a corrupt journal.

Use the actual field names

The dump everything output in 1.0.0.24 has these 14 headers, in this order. The list was checked against _WriteCSVHeader and an actual run on a synthetic V2 fixture. Pinned implementation.

Offset, FileName, USN, Timestamp, Reason, MFTReference,
MFTReferenceSeqNo, MFTParentReference, MFTParentReferenceSeqNo,
FileAttributes, MajorVersion, MinorVersion, SourceInfo, SecurityId

This list uses commas for readability; the export uses your configured separator. File and parent reference sequence numbers are separate columns. Combined notation such as 51200:4 is an analyst shorthand, not this export's native layout.

Check an export against a known fixture

The following selected columns come from constructed V2 test records, parsed by the released x64 program. These are not observations from a real workstation. The browser lab uses the same three records to teach export/import checks.

FileName USN Timestamp at UTC 0.00 Reason MFTReference MFTReferenceSeqNo
budget,final.csv 900000 2026-08-18 02:14:02.1234567 CLOSE+FILE_CREATE 51200 4
résumé.txt 900128 2026-08-18 02:14:03.1234567 CLOSE+DATA_OVERWRITE 51201 4
notes.txt 900256 2026-08-18 02:14:04.1234567 CLOSE+DATA_TRUNCATION 51202 4
  1. 01 · Structure14 fieldsMatch the delimiter
  2. 02 · Textrésumé.txtImport as UTF-8
  3. 03 · TimeUTC 0.00Retain precision
  4. 04 · ReportRecord settingsKeep the original export
Check the import boundary before deriving an incident timeline.
Three errors you can diagnose without guessing
  1. One column: compare the export separator with the viewer's delimiter. Pipe delimited output needs a pipe aware import even though the extension is .csv.
  2. Broken accented name: compare the untouched UTF-8 text with the viewer's decoding. Unicode in this parser is an output encoding choice, not a switch that reconstructs lost filenames.
  3. Times twelve hours later: check the recorded region. In the fixture test, UTC 12.00 produces 14:14:02.1234567 for the same record that UTC 0.00 renders as 02:14:02.1234567. The display changed; it is not a second event.

When using comma separated output, budget,final.csv needs quotation marks to remain one field in a conventional CSV importer. Compare row widths with the header and preserve identifiers as text. Check the literal filename and timestamp against the original export after import.

Interpret the fields within their limits

Field What to check What it does not establish
Offset Position in the input provided to the parser. Do not equate it with the USN or original volume byte offset after sparse extraction.
USN Record position/order within the journal context. It is not the file identity.
Timestamp Recorded value and chosen UTC offset; NanoSec displays seven fractional digits in the tested output. Display precision does not prove clock accuracy.
Reason The parser joins combined reason names with +, such as CLOSE+DATA_OVERWRITE. A row is not necessarily a single user action.
MFTReference + MFTReferenceSeqNo Compare both for V2 identity within one volume. A filename match alone cannot establish identity.
MFTParentReference + sequence Correlate with MFT metadata for directory context. A parent reference is not a full path.

Microsoft documents that multiple changes can be accumulated into reason flags and that old journal records can be discarded. CLOSE concerns closure, not secure deletion. A write or truncation observation does not reveal document contents or identify who acted. Journal behaviour, V2 field definitions.

Write the case note

Record the source volume, input hash, parser build, separator/quoting, encoding, time basis, precision, mode, output filename/hash, import choices, checked row count and limitations. Preserve the original export separately from viewer edits. Passing a fixture confirms those tested transformations; it does not validate every record version or prove journal completeness.

Try Review the analyst export to diagnose these boundaries interactively. The ExtractUsnJrnl lab separately teaches collection and a rename/deletion investigation.

Verification scope and primary references

Reviewed on 19 September 2026 against the UsnJrnl2Csv 1.0.0.24 source and author's usage notes. Case paths, exercise times and synthetic records are teaching data, not facts about your system. Evidence preservation steps are analyst practice, not functions automatically performed by the tool.

The released x64 parser was also checked with a constructed three record V2 fixture for field names, UTF-8 output, separator/quoting, UTC offsets and precision. This is a limited test, not validation of all record versions or damaged inputs.

PreviousConfigure and parseNextHands on labs