Lion Cipher Lab

Track file activity with the Windows USN journal

• Digital Forensics & IR (DFIR)
• Intermediate
• ~50 min
• Free · no account required

Why it matters

Most Windows forensic questions eventually become one question: what did the malware touch, and when? The $MFT tells you the CURRENT state of the filesystem and a handful of timestamps per surviving file, but it is a snapshot — it cannot tell you about the staging binary the dropper already deleted, or the order in which a hundred files were rewritten. The NTFS USN change journal can. NTFS keeps a rolling, append-only log of every change to every file and directory on the volume — creation, data overwrite, rename (recording both the old and the new name), deletion, attribute change — each…

What you'll learn

• defining the NTFS USN change journal ($Extend\$UsnJrnl:$J), a USN record, the file reference number, and the reason bitmask, and explaining why NTFS keeps this log at all
• contrasting the journal (the HISTORY of every change on the volume) with the $MFT (the current state plus a few timestamps per file)
• querying the journal live with fsutil usn queryjournal and reading a single file's USN with fsutil usn readdata
• generating known ground truth — create, rename, overwrite and delete test files — so you can verify a parse against reality
• parsing $J into CSV with Eric Zimmerman's MFTECmd (and knowing why you usually work from a KAPE-collected copy, because $J is locked and sparse on a live volume)
• reading reason flags — FILE_CREATE, DATA_OVERWRITE, RENAME_OLD_NAME/RENAME_NEW_NAME, FILE_DELETE, CLOSE — and correlating them back to your ground truth
• recognising the two signatures that make the journal worth its weight: the ransomware burst (mass RENAME_NEW_NAME + DATA_OVERWRITE in seconds) and the dropper (FILE_CREATE then FILE_DELETE of a staging file that is no longer on disk)
• judgment: when the journal is the right artifact, how to correlate it with $MFT and prefetch, why a deleted/recreated journal is itself an IOC, and the honest limits — it wraps, and it records THAT and WHY, not the contents or the acting process

Steps in this lab

1. What the USN journal is, and why NTFS keeps it
2. See it live, and understand that the journal WRAPS
3. Generate ground truth you can verify the parse against
4. Parse $J into CSV with MFTECmd
5. Read the reason codes and correlate to your ground truth
6. The payoff: read a ransomware run and a dropper out of the journal
7. Judgment: when the journal is the right artifact, and how a pro uses it
8. The honest negative: what the journal cannot tell you

Open the full interactive lab →