71. The $UsnJrnl

• Located in $Extend directory

• Similar to $LogFile, tracks changes that occur on files

• Short-term repository:

  1. some application requests to log the changes via system API

  2. The application reads captured info

  3. NTFS empties the $UsnJrnl file

• Often called the Change Journal.

• Useful for

  • file replication/mirroring applications

  • tracking of which files to include in an incremental backup

  • virus scanners

  • etc.

• The file normally will appear empty: the data exists only while it is being used and goes away as soon as the program that needed it no longer does.