NTFS $UsnJrnl Parser

Tools

License Type
Free
Tool Type
Small Tool
Developer
Guidance/OpenText
Utilities - Misc
EnScripts

This script parses USN_RECORD_V2 change-journal records contained in the $J data stream of the NTFS $UsnJrnl file. It can also search for, and decode, USN_RECORD_V2 records in $LogFile and unallocated clusters.