{"id":13698603,"url":"https://github.com/PoorBillionaire/USN-Journal-Parser","last_synced_at":"2025-05-04T03:31:41.622Z","repository":{"id":1990923,"uuid":"45421076","full_name":"PoorBillionaire/USN-Journal-Parser","owner":"PoorBillionaire","description":"Python script to parse the NTFS USN Journal","archived":false,"fork":false,"pushed_at":"2022-07-15T18:03:01.000Z","size":78,"stargazers_count":97,"open_issues_count":2,"forks_count":15,"subscribers_count":11,"default_branch":"master","last_synced_at":"2024-03-14T21:46:24.498Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/PoorBillionaire.png","metadata":{"files":{"readme":"README.rst","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2015-11-02T20:47:33.000Z","updated_at":"2024-01-11T04:04:22.000Z","dependencies_parsed_at":"2022-08-06T11:16:37.206Z","dependency_job_id":null,"html_url":"https://github.com/PoorBillionaire/USN-Journal-Parser","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PoorBillionaire%2FUSN-Journal-Parser","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PoorBillionaire%2FUSN-Journal-Parser/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PoorBillionaire%2FUSN-Journal-Parser/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PoorBillionaire%2FUSN-Journal-Parser/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/PoorBillionaire","download_url":"https://codeload.github.com/PoorBillionaire/USN-Journal-Parser/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":224383694,"owners_count":17302247,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-02T19:00:50.697Z","updated_at":"2024-11-13T03:31:16.217Z","avatar_url":"https://github.com/PoorBillionaire.png","language":"Python","funding_links":[],"categories":["Tools","Challenges","Python"],"sub_categories":["Windows Artifacts"],"readme":"USN-Journal-Parser\n====================      \nPython script to parse the NTFS USN Change Journal\n\nDescription\n-------------\nThe NTFS USN Change journal is a volume-specific log  which records metadata changes to files. It is a treasure trove of information during a forensic investigation. The change journal is a named alternate data stream, located at: $Extend\\\\$UsnJrnl:$J. usn.py is a script written in Python which parses the journal's contents, and features several different output formats.\n\nDefault Output\n----------------\nWith no command-line options set, usn.py will produce USN journal records in the format below:\n\n::\n\n    dev@computer:$ python usn.py -f usnjournal -o /tmp/usn.txt\n    dev@computer:$ cat /tmp/usn.txt\n\n    2016-01-26 18:56:20.046268 | test.vbs | ARCHIVE  | DATA_OVERWRITE DATA_EXTEND \n\nCommand-Line Options\n-----------------------\n\n::\n\n    optional arguments:\n      -h, --help            show this help message and exit\n      -b, --body            Return USN records in comma-separated format\n      -c, --csv             Return USN records in comma-separated format\n      -f FILE, --file FILE  Parse the given USN journal file\n      -q, --quick           Parse a large journal file quickly\n      -s SYSTEM, --system SYSTEM\n                            System name (use with -t)\n      -t, --tln             TLN output (use with -s)\n      -v, --verbose         Return all USN properties for each record (JSON)\n\n**--csv**\n\nUsing the CSV flag will, as expected, provide results in CSV format. Using the --csv / -c option provides the same USN fields as default output:\n\n* Timestamp\n* Filename\n* File attributes\n* Reason\n\nAn example of what this looks like is below:\n\n::\n\n    dev@computer:~$python usn.py --csv -f usnjournal -o /tmp/usn.txt\n    dev@computer:~$ cat /tmp/usn.txt\n\n    timestamp,filename,fileattr,reason\n    2015-10-09 21:37:58.836242,A75BFDE52F3DD8E6.dat,ARCHIVE NOT_CONTENT_INDEXED,DATA_EXTEND FILE_CREATE\n\n**--body**\n\nUsing the --body / -b command-line flag, the script will output in mactime body format:\n\n::\n\n    dev@computer:~$ python usn.py -f usnjournal --body\n\n    0|schedule log.xml (USN: DATA_EXTEND DATA_TRUNCATION CLOSE)|24603-1|0|0|0|0|1491238176|1491238176|1491238176|1491238176\n\n**--tln / -t**\n\nUsing the --tln / -t command-line flag, the script will output in TLN body format:\n\n::\n\n    dev@computer:~$ python usn.py -f usnjournal --tln\n\n    1491238176|USN|||schedule log.xml:DATA_EXTEND DATA_TRUNCATION CLOSE\n\n\nAdd the --system / -s flag to specify a system name with TLN output:\n\n::\n\n    dev@computer:~$ python usn.py -f usnjournal --tln --system ThisIsASystemName\n\n    1491238176|USN|ThisIsASystemName||schedule log.xml:DATA_EXTEND DATA_TRUNCATION CLOSE\n\n**--verbose**\n\nReturn all USN members for each record with the --verbose / -v flag. The results are JSON-formatted.\n\n::\n\n    dev@computer:~$python usn.py --verbose -f usnjournal -o /tmp/usn.txt\n    dev@computer:~$cat /tmp/usn.txt\n\n    {\n        \"majorVersion\": 2,\n        \"minorVersion\": 0,\n        \"fileReferenceNumber\": 281474976744952,\n        \"parentFileReferenceNumber\": 844424930165539,\n        \"usn\": 47265504,\n        \"timestamp\": 1467312724,\n        \"reason\": \"SECURITY_CHANGE\",\n        \"sourceInfo\": 0,\n        \"securityId\": 0,\n        \"fileAttributes\": \"HIDDEN SYSTEM ARCHIVE\",\n        \"filenameLength\": 22,\n        \"filenameOffset\": 60,\n        \"filename\": \"493fde4.rbf\",\n        \"humanTimestamp\": \"2016-06-30 18:52:04.456762\",\n        \"epochTimestamp\": 1467312724,\n        \"mftSeqNumber\": 1,\n        \"mftEntryNumber\": 34296,\n        \"pMftSeqNumber\": 3,\n        \"pMftEntryNumber\": 33571\n    }\n\nInstallation\n--------------\nUsing setup.py:\n\n::\n    \n    python setup.py install\n    \nUsing pip:\n\n::\n    \n    pip install usnparser\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FPoorBillionaire%2FUSN-Journal-Parser","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FPoorBillionaire%2FUSN-Journal-Parser","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FPoorBillionaire%2FUSN-Journal-Parser/lists"}