$J
$J
- 4 paths
- Version 1.1
- Eric Zimmerman and Andrew Rathbun
Paths on disk
4 paths
References
9 links
- docs.microsoft.com/en-us/windows/win32/fileio/change-journal-records(opens in new tab)
- digital-forensics.sans.org/media/DFIR-Command-Line.pdf(opens in new tab)
- forensicinsight.org/wp-content/uploads/2013/07/F-INSIGHT-Advanced-UsnJrnl-Forensics-English.pdf(opens in new tab)
- countuponsecurity.com/2017/05/25/digital-forensics-ntfs-change-journal/(opens in new tab)
- journeyintoir.blogspot.com/2013/01/re-introducing-usnjrnl.html(opens in new tab)
- tzworks.net/prototype_page.php?proto_id=5(opens in new tab)
- az4n6.blogspot.com/2015/03/usn-journal-where-have-you-been-all-my.html(opens in new tab)
- youtube.com/watch?v=1mwiShxREm8(opens in new tab)
- github.com/rathbuna/DFIRMindMaps/tree/main/FileSystems/NTFS/%24J(opens in new tab)