USN-Journal-Parser
Python script to parse the NTFS USN Change Journal.
Python script to parse the NTFS USN Change Journal.
Checked October 2026.
The NTFS USN Change journal is a volume-specific log which records metadata changes to files. It is a treasure trove of information during a forensic investigation. The change journal is a named alternate data stream, located at: $Extend$UsnJrnl:$J. usn.py is a script written in Python which parses the journal's contents, and features several different output formats.
Default Output With no command-line options set, usn.py will produce USN journal records in the format below: dev@computer:$ python usn.py -f usnjournal -o /tmp/usn.txt dev@computer:$ cat /tmp/usn.txt 2016-01-26 18:56:20.046268 | test.vbs | ARCHIVE | DATA_OVERWRITE DATA_EXTEND Command-Line Options optional arguments: -h, --help show this help message and exit -b, --body Return USN records in comma-separated format -c, --csv Return USN records in comma-separated format -f FILE, --file FILE Parse the given USN journal file -q, --quick Parse a large journal file quickly -s SYSTEM, --system SYSTEM System name (use with -t) -t, --tln TLN output (use with -s) -v, --verbose Return all USN properties for each record (JSON) --csv Using the CSV f
No core features are listed for this product yet, so check the vendor's documentation for the full feature list.
No integrations are listed for this product yet. Check the vendor's documentation, or ask the vendor which integrations and APIs it supports.
Common questions about USN-Journal-Parser: features, pricing and alternatives.
USN-Journal-Parser is a product in the Digital Forensics category. It covers File Analysis.
USN-Journal-Parser is free. Download and setup instructions are at https://github.com/PoorBillionaire/USN-Journal-Parser/.
Alternatives to USN-Journal-Parser listed on CybersecTools:
Compare all USN-Journal-Parser alternatives at https://cybersectools.com/alternatives/usn-journal-parser
USN-Journal-Parser is available as on-premises. It is listed for startup, smb, mid-market and enterprise organizations. It is free.
Side by side: features, pricing model and the company behind each one.
A shell script for basic forensic collection of various artefacts from UNIX systems.
A reverse engineering tool that extracts and organizes Samsung ODIN3 protocol messages from USB packet captures into human-readable files.
A command-line forensics tool for tracking and analyzing USB device artifacts and connection history on Linux systems.
A Python 2.x tool for memory analysis on Mac OS X systems with support for various OS versions and memory image export capabilities.
A digital artifact extraction framework for extracting data from volatile memory (RAM) samples, providing visibility into the runtime state of a system.
Web interface for the Volatility Memory Forensics Framework
On our shortlist?
No shortlist covers this product's category yet. The closest is Best MDR Solutions for Business.
Get a summary of this page from your assistant.
Mandos MCP: ask about all 9,027 products.
Connect your AI
