Where Is the NTFS USN Journal Stored?
Where the NTFS USN Journal lives, why plain copies come back empty, and which tools extract it properly.
Last updated
Every NTFS volume keeps a change journal that logs creates, deletes, renames, and attribute changes. The journal lives as an alternate data stream named $J on the $UsnJrnl metadata file under $Extend. It is a fixed-size ring buffer, so busy disks hold days while quiet ones hold weeks.
Ordinary copies miss it entirely because tools copy the empty default stream. Forensic tools extract the $J stream specifically, and parsers turn it into timelines. The sibling $Max stream holds only size metadata, a classic wrong turn for beginners.
Where Windows stores this, by platform
C:\$Extend\$UsnJrnl:$J
NTFS metadata file with the $J change stream and $Max config stream. Enabled by default since Vista on every NTFS volume. Extract with ADS-aware tools as admin; plain copies yield empty files. Query sizing live with fsutil usn queryjournal.
Frequently asked questions
how do I copy the USN Journal
Use a tool that understands alternate data streams, such as FTK Imager, RawCopy, or the Sleuth Kit icat. Explorer and robocopy silently copy the empty default stream and produce zero-byte files. Live extraction needs administrator rights against the volume handle.
how do I read the USN Journal
Feed the extracted $J stream to a parser like MFTECmd, UsnJrnl2Csv, or usnrs for CSV output. Group by file reference number to rebuild each file's story across renames. Pair with the $MFT to resolve parent chains into full paths.
does the journal keep deleted file records
Yes, until the ring buffer wraps over them. Deletion records survive the file itself and usually outlast MFT reuse and recycle bin metadata. Retention spans days to weeks depending on journal size and disk activity.
Notice an outdated path? Let us know.