USN Journal
An NTFS change journal that records metadata about filesystem modifications and can support forensic reconstruction of file activity.
The USN Journal is the NTFS change journal that records file and directory changes using Update Sequence Number records.
Digital-Forensics Context
The NTFS USN change journal records metadata about filesystem changes and can support reconstruction of create, rename, delete, and other activity. It is most useful when correlated with MFT records and other timeline sources.
Evidence Boundary
The USN Journal is not a complete audit log. Journal wrap, deletion, retention, and the limited information stored in each record mean it cannot describe every user action or every byte-level file change.