1USNJLS(1)                   General Commands Manual                  USNJLS(1)
2
3
4

NAME

6       usnjls - List the contents of a NTFS Update Sequence Number journal
7

SYNOPSIS

9       usnjls  [-f  fstype  ]  [-vV]  [-i imgtype] [-o imgoffset] [-b dev_sec‐
10       tor_size] image [images] [inode]
11
12

DESCRIPTION

14       usnjls lists the records in a NTFS Update Sequence Number Journal.   If
15       inode  is  given, then it will look there for a journal.  Otherwise, it
16       will use the default  location.   The  output  lists  the  USN  journal
17       records.
18
19

ARGUMENTS

21       -f fstype
22              Specify  the  file  system type.  Use '-f list' to list the sup‐
23              ported file system types. If not  given,  autodetection  methods
24              are used.
25
26       -i imgtype
27              Identify  the type of image file, such as raw or split.  Use '-i
28              list' to list the supported types. If not  given,  autodetection
29              methods are used.
30
31       -o imgoffset
32              The sector offset where the file system starts in the image.
33
34       -b dev_sector_size
35              The  size,  in  bytes, of the underlying device sectors.  If not
36              given, the value in the image format is used (if it  exists)  or
37              512-bytes is assumed.
38
39       -l     Print  the output in long format describing the field values and
40              unpacking the data into human readable strings.
41
42       -m     Print the output in mactime format.
43
44       -V     Display version
45
46       -v     verbose output
47
48       image [images]
49              One (or more if split) disk or partition images whose format  is
50              given with '-i'.
51
52       [inode]
53              The inode where the Update Sequence Number Journal can be found.
54
55

EXAMPLES

57       usnjls -f ntfs img.dd
58
59

AUTHOR

61       Brian Carrier <carrier at sleuthkit dot org>
62
63       Send documentation updates to <doc-updates at sleuthkit dot org>
64
65
66
67                                                                     USNJLS(1)
Impressum