USN-Journal-Parser Logo

USN-Journal-Parser

0
Free
Visit Website

The NTFS USN Change journal is a volume-specific log which records metadata changes to files. It is a treasure trove of information during a forensic investigation. The change journal is a named alternate data stream, located at: $Extend$UsnJrnl:$J. usn.py is a script written in Python which parses the journal's contents, and features several different output formats. Default Output With no command-line options set, usn.py will produce USN journal records in the format below: dev@computer:$ python usn.py -f usnjournal -o /tmp/usn.txt dev@computer:$ cat /tmp/usn.txt 2016-01-26 18:56:20.046268 | test.vbs | ARCHIVE | DATA_OVERWRITE DATA_EXTEND Command-Line Options optional arguments: -h, --help show this help message and exit -b, --body Return USN records in comma-separated format -c, --csv Return USN records in comma-separated format -f FILE, --file FILE Parse the given USN journal file -q, --quick Parse a large journal file quickly -s SYSTEM, --system SYSTEM System name (use with -t) -t, --tln TLN output (use with -s) -v, --verbose Return all USN properties for each record (JSON) --csv Using the CSV f

FEATURES

ALTERNATIVES

Rekall is a discontinued project that aimed to improve memory analysis methodology but faced challenges due to the nature of in-memory structure and increasing security measures.

Python script to parse macOS MRU plist files into human-friendly format

A repository containing material from a talk on sub-domain enumeration techniques

DFIR ORC Documentation provides detailed instructions for setting up the build environment and deploying the tool.

Recreates the File/Directory tree structure from an extracted $MFT file with detailed record mapping and analysis capabilities.

Online platform for image steganography analysis

Comprehensive digital forensics and incident response platform for law enforcement, corporate, and academic institutions.

Web interface for the Volatility Memory Forensics Framework