USNJLS(1)

💅 USNJLS(1) — the girlies' guide to listing your NTFS Update Sequence Number journal

okay bestie, welcome to section 1 of the General Commands Manual, where we talk about usnjls 🦋 this is the little tool that lets you peek inside a NTFS Update Sequence Number Journal and see all the records chillin' in there. it's giving forensic detective energy and honestly? obsessed.

✨ NAME ✨

usnjls — List the contents of a NTFS Update Sequence Number journal 👑

🌸 SYNOPSIS 🌸

usnjls [-f fstype ] [-vV] [-i imgtype] [-o imgoffset] [-b
dev_sector_size] image [images] [inode]

💖 DESCRIPTION 💖

so like. usnjls lists the records inside a NTFS Update Sequence Number Journal. that's the whole vibe. 🫶

if you hand it an inode, it's gonna go look right there for a journal — like, "oh you want it from this specific spot? say less." otherwise it just uses the default location, no drama. either way, the output is the USN journal records. periodt. 💅

🎀 ARGUMENTS 🎀

bestie these are the flags, read them carefully, they matter, no cap:

• -f fstype — tell it what file system type you're working with. hit it with -f list and it'll show you all the supported file system types, like a menu but make it ✨informative✨. if you don't give it one, autodetection methods are used. it figures it out itself, main character energy.
• -i imgtype — this one identifies the type of image file, stuff like raw or split. use -i list to see all the supported types (again: little menu, we love her). if you don't give it one, autodetection methods are used. 👑
• -o imgoffset — the sector offset where the file system starts inside the image. like, where does the actual party begin. 🎉
• -b dev_sector_size — the size, in bytes, of the underlying device sectors. if you don't pass it, the value in the image format is used (if it exists) or 512-bytes is assumed. so like, it'll cope either way. 💀
• -l — print the output in long format, describing the field values and unpacking the data into human readable strings. this is the "explain it to me like I'm a person" mode. 🔥
• -m — print the output in mactime format. if you know you know. 😌
• -V — display version. gotta know what you're working with, bestie.
• -v — verbose output. she talks more. we love that for her. 🗣️
• image [images] — one disk or partition image, or more than one if it's split, whose format is given with -i. 🖼️
• [inode] — the inode where the Update Sequence Number Journal can be found. the lil address of the journal itself. 📍

ngl, the -f and -i autodetection is cute, but if you already know your types, just tell her. saves everyone the guesswork. 💜

🌈 EXAMPLES 🌈

here's the moment you've been waiting for, an actual command, look at her go:

usnjls -f ntfs img.dd

that's it. that's the example. iconic. ✨

💜 AUTHOR 💜

Brian Carrier <carrier at sleuthkit dot org> — the legend, the blueprint, the moment. 🫶

send documentation updates to <doc-updates at sleuthkit dot org> — yes queen, contributions welcome, we love a collaborative vibe. 📬

and that's the whole page, bestie 🎀 this one lives in the General Commands Manual, section 1, and the footer is just USNJLS(1) doing its little repeat-at-the-bottom thing — no version number, no date, just the title serving looks one more time. slay, go read your journals. 💅✨