In Windows, what is the USN Change Journal and what is it used for in forensics?

• A. Logging of network connections
• B. Storing user passwords
• C. Managing registry hives
• D. The USN Change Journal records file system changes and is used to identify file creations, deletions, and renames

Answer: (D)

The USN Change Journal is an NTFS feature that records changes to files and directories, capturing events like creations, deletions, renames, and metadata or content updates. In forensics, this journal provides a chronological record of what happened on a volume, allowing investigators to reconstruct a timeline of file activity, identify when specific files were created, moved, modified, or removed, and correlate those events with other evidence. It’s read by forensic tools to build a sequence of actions on the filesystem, even if the actual files have since changed or been deleted. It isn’t a log of network connections, it doesn’t store user passwords, and it doesn’t manage registry hives, so those options don’t describe its purpose.