ZARZA We are Zarza, the prestigious firm behind major projects in information technology.
Listen "DFSP # 015 - $UsnJrnl File"
Episode Synopsis
The $UsnJrnl is an artifact that logs certain changes to files in NTFS volumes. It is a great source of timeline information for malware\ IR investigations, time stomping concerns and anti-forensics activities (i.e. wiping) as well as an additional source of file use and knowledge evidence for disk forensics.
More episodes of the podcast Digital Forensic Survival Podcast
DFSP # 499 Linux top 10
09/09/2025
DFSP # 498 Windows top 10
02/09/2025
DFSP # 497 ticket to ride
26/08/2025
DFSP # 496 Signed, Sealed, Exploited
19/08/2025
DFSP # 495 Corrupted from within
12/08/2025
DFSP # 494 the request is out there
05/08/2025
DFSP # 493 Stop, Share, and Listen
29/07/2025
DFSP # 492 A Bit of TCP
22/07/2025
DFSP # 490 Unveiling the USN Journal
08/07/2025
In God we trust