# USN-Journal-Parser

USN-Journal-Parser is a Digital Forensics product. It runs on-premises. Pricing is free.

Python script to parse the NTFS USN Change Journal.

Checked October 2026.

## What is USN-Journal-Parser?

The NTFS USN Change journal is a volume-specific log which records metadata changes to files. It is a treasure trove of information during a forensic investigation. The change journal is a named alternate data stream, located at: $Extend$UsnJrnl:$J. usn.py is a script written in Python which parses the journal's contents, and features several different output formats.
Default Output
With no command-line options set, usn.py will produce USN journal records in the format below:
dev@computer:$ python usn.py -f usnjournal -o /tmp/usn.txt
dev@computer:$ cat /tmp/usn.txt
2016-01-26 18:56:20.046268 | test.vbs | ARCHIVE | DATA_OVERWRITE DATA_EXTEND
Command-Line Options
optional arguments:
-h, --help show this help message and exit
-b, --body Return USN records in comma-separated format
-c, --csv Return USN records in comma-separated format
-f FILE, --file FILE Parse the given USN journal file
-q, --quick Parse a large journal file quickly
-s SYSTEM, --system SYSTEM System name (use with -t)
-t, --tln TLN output (use with -s)
-v, --verbose Return all USN properties for each record (JSON)
--csv Using the CSV f

Tags: File Analysis

## Where it fits in your security program (NIST CSF 2.0)

- [Respond](https://cybersectools.com/guides/building-respond-program-small-team): helps you contain and handle incidents.

## Quick facts

- Category: [Security Operations](https://cybersectools.com/categories/security-operations) · [Digital Forensics](https://cybersectools.com/categories/digital-forensics)
- Deployment: On-Premises
- Company size fit: Startup, SMB, Mid-Market, Enterprise
- Pricing model: Free
- GitHub stars: 116
- Website: github.com

## Where it ranks

No shortlist covers this product's category yet. The closest is [Best MDR Solutions for Business](https://cybersectools.com/shortlists/best-mdr-solutions).

## USN-Journal-Parser FAQ

### What is USN-Journal-Parser?

USN-Journal-Parser is a product in the Digital Forensics category. It covers File Analysis.

### What is the pricing for USN-Journal-Parser?

USN-Journal-Parser is free. Download and setup instructions are at https://github.com/PoorBillionaire/USN-Journal-Parser/.

### What are alternatives to USN-Journal-Parser?

Alternatives to USN-Journal-Parser listed on CybersecTools:

1. [MailXaminer MIME Header Analyzer](https://cybersectools.com/tools/mailxaminer-mime-header-analyzer) - Email forensics tool for analyzing MIME header fields across 20+ formats. (Commercial)
2. [Cyacomb](https://cybersectools.com/tools/cyacomb) - Digital forensics tools for detecting CSAM on devices and online platforms. (Commercial)
3. [CaseScan](https://cybersectools.com/tools/casescan) - Finds known and new child abuse material for police and online platforms (Commercial)

Compare all USN-Journal-Parser alternatives at [https://cybersectools.com/alternatives/usn-journal-parser](https://cybersectools.com/alternatives/usn-journal-parser)

### What deployment and organization size does USN-Journal-Parser fit?

USN-Journal-Parser is available as on-premises. It is listed for startup, smb, mid-market and enterprise organizations. It is free.

## Compare USN-Journal-Parser with similar solutions

- [USN-Journal-Parser vs MailXaminer MIME Header Analyzer](https://cybersectools.com/compare/mailxaminer-mime-header-analyzer-vs-usn-journal-parser)
- [USN-Journal-Parser vs Cyacomb](https://cybersectools.com/compare/cyacomb-vs-usn-journal-parser)
- [USN-Journal-Parser vs CaseScan](https://cybersectools.com/compare/casescan-vs-usn-journal-parser)

All alternatives to USN-Journal-Parser: [/alternatives/usn-journal-parser](https://cybersectools.com/alternatives/usn-journal-parser)

---

Source: https://cybersectools.com/tools/usn-journal-parser

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on USN-Journal-Parser: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md