USN Journal and Log...
 
Notifications
Clear all

USN Journal and Log file analysis

12 Posts
4 Users
0 Reactions
10.3 K Views
(@wotsits)
Reputable Member
Joined: 11 years ago
Posts: 253
Topic starter  

One other question - if you copy a file from the external drive to another drive will that action be recorded in the UsnJrnl or not?



   
ReplyQuote
JimC
 JimC
(@jimc)
Estimable Member
Joined: 9 years ago
Posts: 86
 

$UsnJrnl is a change journal. It will be recorded in the journal on the target file system (if it is NTFS).

It probably won't result in an entry on the source file system (unless by luck, the last accessed time is updated which it probably won't be).

This may have been mentioned already, but if both file systems are NTFS, you may find you can tie the files together using the $OBJECT_ID attribute.

Jim

www.binarymarkup.com



   
ReplyQuote
Page 2 / 2
Share: