zoukankan      html  css  js  c++  java
  • Windows USN Journal Parsing

    What is "USN Journal"? It is "Update Sequence Number Journal". It records changes in the NTFS volume. The scenario is about Bomb threat. I use X-Ways Forensics to parse USN Journal and the screenshot below is the parsing result. You could see the column name - "Timestamp","Change type","File ID","Attribue" and "Filename".

    Where is USN Journal? That's it. A strange file whose name is $USNJml:$J. What is $J? It is so called ADS(Alternate Data Stream). Usually ADS will contain metadata of that file.

    Let's take the first reocrd in the screenshot for examplie. The file "炸彈製作.lnk" created means suspect did double click the folder "炸彈製作" and the timestamp was 2013/12/16 21:50:41. The other records also had something to do with "Bomb" at 2013/12/16 21:50. So we could know that suspect did access those folders and files that time, and no doubt those files and folders did exist at that time. Look into USN parsing result and we could get  a whole picture of "Timeline".

  • 相关阅读:
    python-04
    python-03
    python-02
    python-01
    day4-RHCS
    python 之元组(tuple)
    11.21
    python之猜数小游戏
    python之简陋的数据库
    11.20
  • 原文地址:https://www.cnblogs.com/pieces0310/p/4970250.html
Copyright © 2011-2022 走看看