USN Journal and Log...
 
Notifications
Clear all

USN Journal and Log file analysis

12 Posts
4 Users
0 Reactions
6,135 Views
(@wotsits)
Reputable Member
Joined: 10 years ago
Posts: 253
Topic starter  

One other question - if you copy a file from the external drive to another drive will that action be recorded in the UsnJrnl or not?


   
ReplyQuote
JimC
 JimC
(@jimc)
Estimable Member
Joined: 9 years ago
Posts: 86
 

$UsnJrnl is a change journal. It will be recorded in the journal on the target file system (if it is NTFS).

It probably won't result in an entry on the source file system (unless by luck, the last accessed time is updated which it probably won't be).

This may have been mentioned already, but if both file systems are NTFS, you may find you can tie the files together using the $OBJECT_ID attribute.

Jim

www.binarymarkup.com


   
ReplyQuote
Page 2 / 2
Share: