Parse Windows NTFS USN Journal ($UsnJrnl:$J) files entirely in your browser. Files never leave your machine.
Sample: synthetic files from a fictional intrusion (host FIN-WKS-07). No real data.
Files never leave your machine.
$J is a hidden, locked NTFS stream: Explorer, copy and robocopy give you an empty file or an access error. The first tab gets you the real bytes in about two minutes.
$J (+ $MFT)You need: KAPE (free, from Kroll) unzipped on the host or a USB drive, and a console opened as administrator in the KAPE folder.
kape.exe --tsource C: --tdest C:\triage --target $J,$MFT$J is read as a variable).\kape.exe --tsource C: --tdest C:\triage --target '$J,$MFT'Result: C:\triage\C\$Extend\$J / C:\triage\C\$MFT. Drop the C:\triage\C folder here, or a ZIP of it.
kape.exe --tsource C: --tdest C:\triage --target KapeTriageThe KapeTriage compound target already includes $J and $MFT. Zip the output folder and drop the ZIP: only the journal and $MFT are read from it, everything else is ignored.
Build an offline collector with the Windows.Triage.Targets artifact from the Velociraptor Triage project (formerly Windows.KapeFiles.Targets on older releases) and select the J and MFT targets (or KapeTriage). Run it as administrator on the host and drop the collection ZIP here as-is.
Windows.Forensics.Usn parses the journal on the endpoint instead: its output is a table of records, not the raw $J this parser reads.
File → Add Evidence Item → Image File, then open the .E01 / .dd.[root] → $Extend → $UsnJrnl.$J row (not $Max) → Export Files…. Export [root] → $MFT the same way.Mount it read-only, then run the KAPE command against the mounted drive letter (E: here):
kape.exe --tsource E: --tdest C:\triage --target $J,$MFT$Extend (MFT record 11) and note the address printed before $UsnJrnl:$J, e.g. 64-128-4fls image.dd 11 | grep UsnJrnl$J: replace <address> with that addressicat image.dd <address> > UsnJrnl-J.bin$MFT (record 0) for full pathsicat image.dd 0 > MFT.binWhole-disk image rather than a single volume: add -o and the partition's start sector (from mmls image.dd) to each command. Then drop both .bin files here together.
$J stream) on the system volume: same path on every Windows versionC:\$Extend\$UsnJrnl:$J\$Extend\$UsnJrnl:$J$MFT (optional, same volume): turns bare file names into full pathsC:\$MFTDrop $J and $MFT together, their folder, or a ZIP (not 7z / RAR / gzip). With several volumes in one collection you pick the journal to open; $Max is recognised and skipped.
fsutil usn queryjournal C:A non-zero Maximum Size means the journal is active. If fsutil reports that the journal is not active, there is nothing to collect on that volume.
copy or robocopy never give you the journal: $J needs a raw NTFS reader (the tools above) and administrator rights on a live host.$Max, not $J, and fsutil usn readjournal output is text, not a journal. A long run of zeroes at the start of $J is normal.Built for triage
A WebAssembly port of a battle-tested Rust parser, wrapped in a workspace designed for the questions you actually ask of a USN journal.
See bursts of activity at a glance and click any bar to zoom the table to that window.
Add the volume's $MFT and every record gets its resolved path, not just a bare file name.
One click for creations, renames, overwrites or deletions; combine with text and time-range filters.
Flags sustained DataOverwrite + RenameNewName bursts, the signature of an encryption run.
Export exactly what is filtered — straight into Timeline Explorer, a SIEM or mactime.
Records stream in while parsing and the table stays smooth thanks to virtualized rendering.
Every analysis is kept in this browser with its filters. Name it, come back tomorrow, pick up where you left off.
Drop a KAPE or Velociraptor ZIP, or a folder: $J and $MFT are found and paired per volume, and anything unusable is explained.
How it works
Extract \$Extend\$UsnJrnl:$J with KAPE, FTK Imager or RawCopy — plus $MFT if you want full paths.
The parser runs in a Web Worker on your machine. Nothing is uploaded, nothing is logged.
Filter, pivot on the timeline, open any record and export the slice you need.
The Update Sequence Number Journal is a change log that NTFS maintains for every file create, delete, rename and metadata modification on a volume. It lives in the alternate data stream \$Extend\$UsnJrnl:$J and is one of the richest sources of timeline evidence in Windows forensics.
Read the full NTFS USN Journal guide →Incident response, intrusion timelines, ransomware analysis, insider-threat investigations — any case where you need a record of file activity even after files have been deleted from disk.
Journal files contain artefacts of every action on the volume — sensitive by nature. This tool ships a WebAssembly parser to your machine; the file never reaches our servers, and there is nothing to log.
Free, private and open source. Drop a journal and start reading the volume's history.
Open a $J file