Crate usnjrnl_forensic 

NTFS USN Journal parser with full path reconstruction via journal rewind.

Implements the CyberCX “Rewind” algorithm for complete path resolution, even when MFT entries have been reallocated. Also provides direct binary parsing of $UsnJrnl:$J (V2/V3/V4), $MFT correlation, $MFTMirr comparison, and $LogFile gap detection.

Modules

image

Disk image format detection and NTFS artifact extraction.

monitor

Real-time USN Journal monitoring via FSCTL_READ_USN_JOURNAL.

output

Output formatters: CSV, JSON, SQLite, Bodyfile, TLN, XML.

usn

USN Journal extraction built on ntfs_core’s parser core.