{"id":24162626,"url":"https://github.com/CyberCX-DFIR/usnjrnl_rewind","last_synced_at":"2025-09-20T07:31:41.737Z","repository":{"id":232731934,"uuid":"784596049","full_name":"CyberCX-DFIR/usnjrnl_rewind","owner":"CyberCX-DFIR","description":"USN Journal full path builder","archived":false,"fork":false,"pushed_at":"2024-09-16T00:17:26.000Z","size":19,"stargazers_count":49,"open_issues_count":0,"forks_count":4,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-01-12T18:03:42.050Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/CyberCX-DFIR.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-04-10T06:54:39.000Z","updated_at":"2025-01-12T01:12:07.000Z","dependencies_parsed_at":null,"dependency_job_id":"55ab7403-cad4-40fb-84ac-603a0a37f16a","html_url":"https://github.com/CyberCX-DFIR/usnjrnl_rewind","commit_stats":null,"previous_names":["cybercx-dfir/usnjrnl_rewind"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/CyberCX-DFIR/usnjrnl_rewind","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CyberCX-DFIR%2Fusnjrnl_rewind","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CyberCX-DFIR%2Fusnjrnl_rewind/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CyberCX-DFIR%2Fusnjrnl_rewind/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CyberCX-DFIR%2Fusnjrnl_rewind/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/CyberCX-DFIR","download_url":"https://codeload.github.com/CyberCX-DFIR/usnjrnl_rewind/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CyberCX-DFIR%2Fusnjrnl_rewind/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":276064222,"owners_count":25578997,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-20T02:00:10.207Z","response_time":63,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-01-12T18:01:22.315Z","updated_at":"2025-09-20T07:31:41.484Z","avatar_url":"https://github.com/CyberCX-DFIR.png","language":"Python","funding_links":[],"categories":["Other Lists"],"sub_categories":["🛡️ DFIR:"],"readme":"# Usnjrnl Rewind / USN full path builder\n\nFor an explanation of Usnjrnl Rewind, read the blog post [here](https://cybercx.com.au/blog/nfts-usnjrnl-rewind/)).\n\nThis script will process the outputs of Eric Zimmerman's MFTEcmd tool and produce a csv that has the complete and correct path for every file and folder (no more Unknowns). \n\nIt uses a different method to compute the full paths, essentially by _rewinding_ the journal and keeping track of all  changes as they occur going from the last entry in the journal to the first. \n\n_If your journal has no gaps (under normal circumstances there should not be any), then there should be no unknown paths in the output._\n\n### Usage\n```\n$ python3 usnjrnl_rewind.py –h\n\nusage: usnjrnl_rewind.py [-h] [-m MFT_PROCESSED_CSV_FILE] [-u USNJRNL_PROCESSED_CSV_FILE] output_path\n\nUSN full path builder v0.4\n\npositional arguments:\n  output_path           Output folder path (will create if non-existent)\n\noptional arguments:\n  -h, --help            show this help message and exit\n  -m MFT_PROCESSED_CSV_FILE, --mft_processed_csv_file MFT_PROCESSED_CSV_FILE\n                        processed $MFT csv from MFTECMD (required)\n  -u USNJRNL_PROCESSED_CSV_FILE, --usnjrnl_processed_csv_file USNJRNL_PROCESSED_CSV_FILE\n                        processed $Usnjrnl:$J csv from MFTECMD (required)\n\n(c) 2024 Yogesh Khatri, CyberCX\n\nThis tool needs the output of Mftecmd for both USN and MFT \n(no need to process both together when processing the USN in mftecmd)\n```\n\n### Sample output\n```\n% python3 usnjrnl_rewind.py -m mftv3.csv -u usnv3.csv rewind_out\n[.] Creating an SQLite database here: ./rewind_out/NTFS.sqlite\n[.] Adding MFT data to database..\n[.] Adding USNJRNL:$J data to database..\n[.] Database creation time: 00:00:05\n[.] ..Rewinding journal and computing the full paths now..\n[.] Created the USNJRNL full path csv here: ./rewind_out/USNJRNL.fullPaths.csv\n[.] Adding full path data to database..\n[.] Finished in total time: 00:00:08\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FCyberCX-DFIR%2Fusnjrnl_rewind","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FCyberCX-DFIR%2Fusnjrnl_rewind","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FCyberCX-DFIR%2Fusnjrnl_rewind/lists"}