Login  |  繁體中文
感謝您對「自由軟體鑄造場」的支持與愛護,十多年來「自由軟體鑄造場」受中央研究院支持,並在資訊科學研究所以及資訊科技創新研究中心執行,現已完成階段性的任務。 原網站預計持續維運至 2021年底,網站內容基本上不會再更動。本網站由 Denny Huang 備份封存。
也紀念我們永遠的朋友 李士傑先生(Shih-Chieh Ilya Li)。

What is Resource Catalog ?

catalog-iconThe OpenFoundry Resource Catalog lists professional resources and applications related to the development of open source software. If you have any recommendation listing / category  or bug for this resource catalog, please do not hesitate to contact us.

Parser-usnjrnl

Rate this listing
0 vote

Python script to parse NTFS transaction log entries from the UsnJrnl alternate data stream. The $USNJRNL logs changes to the NTFS file system. It will record that changes occurred to file data or metadata, but will not record the content of the changes. It is enabled by default in Vista and is optional in XP. All Windows version after XP have the capability to log changes. On systems where the $USNJRNL is enabled, it can be found at the root of the NTFS partition in the $EXTEND folder. The file consists of two data streams, $USNJRNL $MAX and $USNJRNL $J. The $J data stream actually contains the transaction log entries that this tool is intended to parse. This tool is intended to assist in computer forensics examinations of Windows systems. It will provide a description of the change, the filename, and the timestamp for each log entry.