# Finding Evidence of Deleted Files with USN Journal Analysis

In the context of **Master File Table (MFT)** entries in NTFS file systems, **"in-use"** and **"not in-use"** are terms that describe the status of MFT records.

<figure><img src="/files/6RC9QhX5Q3rxLRpi5kPQ" alt=""><figcaption></figcaption></figure>

<table><thead><tr><th width="194">Term</th><th>Description</th></tr></thead><tbody><tr><td><strong>In-Use</strong></td><td>The MFT entry is <strong>active</strong> and points to an existing file or directory.</td></tr><tr><td></td><td>The file/directory is currently present on the file system.</td></tr><tr><td><strong>Not In-Use</strong></td><td>The MFT entry is <strong>inactive</strong> and has been marked for reuse.</td></tr><tr><td></td><td>The file/directory has been <strong>deleted</strong>, but its metadata remains until the space is overwritten.</td></tr></tbody></table>

#### **How It Works**

1. **When a file is created**:
   * A new MFT entry is allocated and marked **in-use**.
2. **When a file is deleted**:
   * The MFT entry is marked as **not in-use**, but the metadata and file content may remain on disk until overwritten.
3. **Forensic Use**:
   * "Not in-use" entries allow forensic investigators to recover deleted files, extract timestamps, or analyze remnants of file metadata.

<figure><img src="/files/dm2QGzOWsqR1R6BzjE3U" alt=""><figcaption></figcaption></figure>

Let’s examine the details of the "SRU00078.log" file using its Entry Number.

```bash
MFTECmd.exe -f C:\Cases\E\$MFT --de 176972
```

<figure><img src="/files/jdYMjh2m5GjhwOU3wWNd" alt=""><figcaption></figcaption></figure>

The **`IsFree`** flag means this MFT entry is **not in use**. The file associated with this entry has been deleted, and the MFT entry is available for reuse.

**Resident**: `False`

* The file data is stored **outside** the MFT entry, meaning it's non-resident data.

**DataRuns Entries**: Specifies the physical cluster location on disk:

* `0x9E2F5`: Starting cluster.
* `0x10`: The number of clusters allocated (16 clusters × 4 KB = 64 KB).

## Analyzing the USN Journal for deleted files

Q) When was the file "deleteme\_T1551.004" created and deleted ?

The **USN Journal (Update Sequence Number Journal)** is a valuable artifact in forensic investigations for tracking changes to files and directories on an NTFS volume. It records metadata changes, including file creations, modifications, renames, and deletions.

**$Extend\\$UsnJrnl:** Tracks file and directory changes on an NTFS volume.

* **$Max:** Contains metadata about the USN Journal configuration.
* **$J:** Contains records of filesystem operations.

We can see the two files in our Cases folder.

<figure><img src="/files/ZtGsR8FtjMzzmZJY7hzg" alt=""><figcaption></figcaption></figure>

Now, let's parse the $J file.

```bash
MFTECmd.exe -f C:\Cases\E\$Extend\$J -m C:\Cases\E\$MFT --csv C:\Cases\Analysis\NTFS
```

<figure><img src="/files/tHPGBkyJYauy6qr1dD8A" alt=""><figcaption></figcaption></figure>

* $MFT file to use when -f points to a $J file

<figure><img src="/files/TLkqfNlzdy8PelQay4ce" alt=""><figcaption></figcaption></figure>

Let's open "**MFTECmd\_$J\_Output.csv"** using Timeline Explorer and search for "deleteme\_T1551.004" file.

<figure><img src="/files/WlImwama8gPzdrsSwmhb" alt=""><figcaption></figcaption></figure>

Let's scroll to the right.

<figure><img src="/files/3qVLXm2cfD88HJkTAyOm" alt=""><figcaption></figcaption></figure>

The Update Timestamps are visible by scrolling to the left.

<figure><img src="/files/S68iw6hDsSovUw3Oc7ts" alt=""><figcaption></figcaption></figure>

* **File Create:** 2024-12-12 08:08:58
* **File Deleted:** 2024-12-12 08:08:59

Q) What was the Entry Number for "deleteme\_T1551.004" and does it still exist in the MFT ?

We already know its Entry Number.

<figure><img src="/files/ihQuyTlhLt96uITg5zcy" alt=""><figcaption></figcaption></figure>

```bash
MFTECmd.exe -f C:\Cases\E\$MFT --de 1987
```

<figure><img src="/files/mClUjiiYqQyvoj5SnSkx" alt=""><figcaption></figcaption></figure>

The space in the MFT that was previously occupied by the `deleteme_T1551.004` file have been reused or overwritten by another file, in this case, `WuProvider...etl`. This could happen if the original file was deleted or its entry was recycled after being deleted or modified.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://faresbltagy.gitbook.io/footprintinglabs/practical-windows-forensics/finding-evidence-of-deleted-files-with-usn-journal-analysis.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.