Friday, February 12, 2016

Forensic Friday: Get-ForensicUsnJrnl

[This article is a continuation of my Forensic Friday series.  Every Friday I will provide a short post on a forensic topic of interest or PowerForensics functionality (such as cmdlet descriptions, use cases, and details about lesser known features). Subscribe to Invoke-IR so you don’t miss a Forensic Friday!]

Welcome back to Forensic Friday! This week I want to highlight the Get-ForensicUsnJrnl cmdlet, which parses the $UsnJrnl file or NTFS change journal.The UsnJrnl is responsible for keeping track of file system operations such as file creation, deletion, and truncation. During an investigation I highly recommend inspecting the $UsnJrnl as it provides extremely detailed context about what has transpired on the file system. For example, this is especially helpful in providing details about a deleted and otherwise unrecoverable file.

Common Use

By default, this cmdlet parses the $UsnJrnl file (\$Extend\$UsnJrnl) on the system’s C: volume, but can be pointed at any logical volume. An exported $UsnJrnl file can be parsed using the -Path parameter in order to perform offline analysis. I’ve listed a few examples below. The -Usn parameter tells Get-ForensicUsnJrnl to parse and return a single entry.

Parse a volume’s UsnJrnl & store in $usn variable (Example using volume “C:”):
$usn = Get-ForensicUsnJrnl -VolumeName C:

Parse $UsnJrnl file based on path & store in $usn variable (Example path C:\$Extend\$UsnJrnl):
$usn = Get-ForensicUsnJrnl -Path ‘C:\$Extend\$UsnJrnl’

Parse $UsnJrnl entry based on Update Sequence Number (Example with Usn #1189553536):
Get-ForensicUsnJrnl -VolumeName C: -Usn 1189553536


  1. Your article helped me out to complete my university project. We are the best Landscaping Services in Sacramento CA that you can rely on. We have been serving the Sacramento area for over 10 years and we are confident that we can fulfill all of your landscaping needs.

  2. Can I just say what a comfort to uncover somebody that genuinely knows what they are discussing on the net. You certainly understand how to bring a problem to light and make it important. 메이저사이트


- Invoke-IR - By Jared Atkinson -