2

There is a utility that can be run on the Microsoft Windows command line called fsutil. One of the commands that it accepts is fsutil usn readjournal <volume pathname> along with several other arguments. Is there documentation on how to read the data produced by the program? My specific interests are how to interpret and use the File ID and Parent file ID fields. Since File name does not include the full path, it is unclear how one should determine if the file may be of interest based on location.

Example Record

Usn               : 9149751384
File name         : Preferences~RF101ac0ae.TMP
File name length  : 52
Reason            : 0x80000200: File delete | Close
Time stamp        : 7/12/2018 11:04:30
File attributes   : 0x00000020: Archive
File ID           : 0000000000000000000500000000a67b
Parent file ID    : 0000000000000000000500000003fa3c
Source info       : 0x00000000: *NONE*
Security ID       : 0
Major version     : 3
Minor version     : 0
Record length     : 128
2

That output corresponds to the USN_RECORD_V3 data structure. Regarding the ID rows, every object on an NTFS volume has a numeric identifier. The "file ID" line gives you the ID of the file affected by that update; the "parent file ID" is the ID of the directory containing it.

To get a path to the file, you can use another mode of this utility: fsutil file queryFileNameById. It takes a volume path and a file ID (with 0x prepended), and returns a full path. I say "a" path and not "the" path because NTFS allows hardlinks, which give different paths to the same file. Exactly which path is returned in that case is arbitrary. The vast majority of files only have one link/path, though.

Let's do an example. I have this USN record:

Usn               : 46966427728
File name         : settings.dat
File name length  : 24
Reason            : 0x80000001: Data overwrite | Close
Time stamp        : 7/11/2018 21:50:57
File attributes   : 0x00000020: Archive
File ID           : 00000000000000000005000000170d13
Parent file ID    : 0000000000000000001200000019ab0e
Source info       : 0x00000000: *NONE*
Security ID       : 0
Major version     : 3
Minor version     : 0
Record length     : 104

Let's use the file ID to find the path to the file:

fsutil file queryFileNameById C:\ 0x00000000000000000005000000170d13

The result:

A random link name to this file is \\?\C:\Users\Ben\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\Settings\settings.dat

It looks like this file is some sort of configuration storage for the Photos app. In the case of your USN record, the file is probably deleted now, so you'll have to use the parent ID to find where it was. If I query by my file's parent ID...

fsutil file queryFileNameById C:\ 0x0000000000000000001200000019ab0e

...I get just the path to the folder, not the settings.dat file:

A random link name to this file is \\?\C:\Users\Ben\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\Settings
| improve this answer | |
  • Do you have any knowledge on how to access this information programmatically? I could write a program in Python 3.7 that would read standard output and parse the lines coming from fsutil, but a package that handles such details already would be ideal. – Noctis Skytower Jul 12 '18 at 19:05
  • @NoctisSkytower Accessing this information is generally done using DeviceIoControl, a native Windows function. This Python tool might be close to what you're after, though. – Ben N Jul 12 '18 at 19:42
  • Yes, the program came to my attention but was not clear on usage. It also does not appear to be support the wait and tail options available on the fsutil usn readjournal command. Parsing standard output seems to the best choice at the moment. – Noctis Skytower Jul 12 '18 at 19:55
  • @NoctisSkytower late reply but one of the authors of script guys wrote a powershell module to read the journal here: powershellgallery.com/packages/PoshUSNJournal/0.4.3.0 – Riley Carney Mar 15 '19 at 18:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.