Parsing Windows Event Logs & NTFS USN Journal for Unauthorized Access

1. The Forensic Triad: Windows Event Logs (EVTX), NTFS USN Journal ($UsnJrnl) & Unauthorized Intrusion Reconstruction

In digital forensics, cybersecurity incident response, and trade secret theft investigations, reconstructing the exact sequence of unauthorized system access requires analyzing multiple independent operating system telemetry streams. Attackers frequently attempt to cover their tracks by clearing Windows Event Logs, modifying file timestamps (“timestomping”), or executing anti-forensic wiper utilities.

However, modern Windows systems record a dual-layer transactional history that cannot be easily sanitized without leaving glaring forensic artifacts. This forensic foundation consists of:

• Windows XML Event Logs (EVTX): Structured system, security, and application journals documenting user authentication, network logon types, privilege delegation, PowerShell executions, and scheduled task creations.
• NTFS Update Sequence Number (USN) Change Journal ($Extend\\$UsnJrnl:$J): A low-level filesystem stream maintained directly by the NTFS filesystem driver (Ntfs.sys), recording every file and folder creation, modification, rename, and deletion with nanosecond-precision 64-bit UTC timestamps.

By programmatically correlating EVTX logon session IDs (TargetLogonId) with USN Journal file change events, forensic examiners can conclusively prove which user account or rogue process accessed sensitive directories, staged data into compressed zip containers, and exfiltrated intellectual property.

In corporate insider threat investigations, rogue employees often stage intellectual property over days or weeks prior to departure. While standard security log audits might show normal interactive logins, matching those session windows against rapid bursts of NTFS journal record creations uncovers the precise moments when proprietary CAD drawings, customer relationship databases, or source code repositories were compressed into staging archives and transferred to external media.

Kerberos Ticket Requests & Lateral Movement Detection

In Active Directory domain environments, unauthorized lateral movement frequently leverages credential theft attacks such as Pass-the-Hash, Pass-the-Ticket, and Kerberoasting. Security event logs capture these operations across dedicated Kerberos authentication events:

• Event ID 4768 (A Kerberos authentication ticket (TGT) was requested): Validates initial credential verification against the Domain Controller. High failure rates with Result Code 0x18 indicate bad passwords (brute force), while 0x25 indicates clock skew.
• Event ID 4769 (A Kerberos service ticket (TGS) was requested): Unmasks service ticket requests. Service Name requests matching high-privilege service accounts (SPNs) with Ticket Encryption Type: 0x17 (RC4-HMAC) are primary indicators of Kerberoasting attacks.
• Event ID 4776 (The computer attempted to validate the credentials for an account – NTLM): Reveals fallback or legacy NTLM authentication, critical for identifying lateral movement across non-Kerberos network paths.

Understanding event log and journal parsing connects directly with our companion guides on Digital Forensics Artifact Parsing: Registry, Prefetch & Shimcache Extraction and Forensic Triage Methodologies in Enterprise Incident Response.

+---------------------------------------------------------------------------------------------------+
|               EVTX & NTFS USN JOURNAL FORENSIC CORRELATION ENGINE ARCHITECTURE                    |
+---------------------------------------------------------------------------------------------------+
| [INPUT 1: WINDOWS SECURITY EVTX STREAM]     [INPUT 2: NTFS $UsnJrnl:$J METADATA]                  |
|   ├── Event 4624 (Logon Type 10 / RDP)        ├── USN Record Offset & File Reference              |
|   ├── Event 4672 (Special Privileges Assigned)├── 64-bit UTC Timestamp                            |
|   ├── Event 4688 (Process Creation / CLI)     ├── Reason Code: FILE_CREATE | EXTEND               |
|   └── Event 7045 (New Service Installed)      └── MFT Entry ID & Sequence Number                  |
+---------------------------------------------------------------------------------------------------+
                                            ▼
+---------------------------------------------------------------------------------------------------+
| [STAGE 3: TEMPORAL SYNCHRONIZATION & LOGON ID CORRELATION]                                        |
|   ├── Aligning EVTX TimeCreated with USN 100-Nanosecond File System Clocks                        |
|   ├── Mapping TargetLogonId to Concurrent Process PIDs & Parent Process Trees                     |
|   └── Tracking File Access Sequences During Active User Interactive Sessions                      |
+---------------------------------------------------------------------------------------------------+
                                            ▼
+---------------------------------------------------------------------------------------------------+
| [STAGE 4: ATTACK PATTERN DETECTION & ANTI-FORENSIC TRIAGE]                                        |
|   ├── Staging Detection: 7-Zip/WinRAR Execution + Rapid Large File Data Extends                   |
|   ├── Timestomping Detection: $STANDARD_INFORMATION vs USN Inconsistency Flagging                 |
|   └── Log Tampering: Event 1102 (Log Cleared) vs Preserved Unallocated USN Stream                 |
+---------------------------------------------------------------------------------------------------+

2. Technical Architecture: Correlating EVTX Security Events with NTFS File System Transactions

A comprehensive forensic correlation pipeline synchronizes event log entries with file system journal records to build an unbroken chronological attack narrative:

The NTFS Journaling Architecture: $MFT, $LogFile, and $UsnJrnl Interaction

To appreciate why USN journal entries cannot be forged in user space, examiners must understand the low-level NTFS storage subsystem:

• The Master File Table ($MFT): The central index of all files and directories on the volume. Each record occupies 1,024 bytes and stores standard information ($STANDARD_INFORMATION, attribute 0x10) and filename attributes ($FILE_NAME, attribute 0x30).
• The Transaction Log File ($LogFile): A circular transactional journal (typically 64 MB) utilized by the NTFS log manager to guarantee volume metadata integrity. It stores redo and undo transaction records for active operations.
• The USN Change Journal ($Extend\\$UsnJrnl:$J): Unlike $LogFile which discards committed transactions, the USN Journal is a sparse stream that records an append-only historical audit trail of all completed filesystem changes. When a file is modified, the kernel writes the transaction to $LogFile, updates the MFT, and commits a new record to $UsnJrnl:$J with the corresponding 64-bit USN offset.

Key Windows Security Event IDs for Access & Lateral Movement Investigations

3. Deep-Dive Forensic Artifact Analysis: Event IDs & $UsnJrnl Reason Codes

To accurately interpret NTFS filesystem activity, examiners must understand the binary structure of $UsnJrnl_V2 records:

1. Anatomy of an NTFS USN_RECORD_V2 Structure

Each journal transaction entry contains essential file system telemetry:
• FileReferenceNumber (8 bytes): The 48-bit Master File Table (MFT) record number and 16-bit sequence number uniquely identifying the file.
• ParentFileReferenceNumber (8 bytes): Identifies the directory path containing the file, allowing full path reconstruction.
• Usn (8 bytes): Monotonically increasing Update Sequence Number.
• TimeStamp (8 bytes): 64-bit Windows FILETIME (100-nanosecond intervals since January 1, 1601 UTC).
• Reason (4 bytes): A 32-bit bitmask encoding the exact operational triggers.
• FileNameLength & FileName: The UTF-16 encoded name of the target file.

2. Tracking LOLBins & PowerShell Script Block Logging (Event ID 4104)

Modern attackers rarely drop uncompiled custom malware; they rely on Living-off-the-Land Binaries (LOLBins) such as Certutil.exe, Bitsadmin.exe, Mshta.exe, and PowerShell.exe. Correlating event logs provides complete visibility into these stealthy vectors:
• PowerShell Event 4104 (Script Block Logging): Captures the complete, de-obfuscated script code executed in memory, revealing base64 payloads and memory injection routines.
• Windows Defender Event 1116 / 1117: Records malware detection and remediation actions, identifying attempted payload drops.
• Bitsadmin & BITS Client Events (Event 59 / 60): Documents asynchronous background file downloads used to bypass perimeter proxy controls.

3. Decoding USN Journal Reason Bitmasks

4. Automated Forensic Extraction Python Scripting & Incident Timeline Reconstruction

Below is a production-grade Python script designed to parse raw NTFS $UsnJrnl:$J binary records, decode operational bitmasks, and correlate file modifications with Windows Security EVTX event logs:

import struct
import json
from datetime import datetime, timedelta, timezone
from dataclasses import dataclass, asdict
from typing import List, Dict, Optional, Tuple, Any

USN_REASONS = {
    0x00000001: "DATA_OVERWRITE",
    0x00000002: "DATA_EXTEND",
    0x00000004: "DATA_TRUNCATION",
    0x00000100: "FILE_CREATE",
    0x00000200: "FILE_DELETE",
    0x00001000: "RENAME_OLD_NAME",
    0x00002000: "RENAME_NEW_NAME",
    0x80000000: "CLOSE"
}

@dataclass
class USNRecord:
    usn: int
    timestamp_utc: str
    file_name: str
    mft_entry_id: int
    parent_entry_id: int
    reasons: List[str]

def parse_filetime(filetime_int: int) -> str:
    try:
        dt = datetime(1601, 1, 1, tzinfo=timezone.utc) + timedelta(microseconds=filetime_int // 10)
        return dt.isoformat()
    except:
        return "1970-01-01T00:00:00Z"

def parse_usn_v2_record(data: bytes, offset: int) -> Tuple[Optional[USNRecord], int]:
    if len(data) - offset < 60:
        return None, offset

    record_len = struct.unpack_from("<I", data, offset)[0]
    if record_len == 0 or record_len > 1024:
        return None, offset + 8

    major_ver, minor_ver = struct.unpack_from("<HH", data, offset + 4)
    if major_ver != 2:
        return None, offset + record_len

    file_ref = struct.unpack_from("<Q", data, offset + 8)[0]
    parent_ref = struct.unpack_from("<Q", data, offset + 16)[0]
    usn = struct.unpack_from("<Q", data, offset + 24)[0]
    filetime_raw = struct.unpack_from("<Q", data, offset + 32)[0]
    reason_code = struct.unpack_from("<I", data, offset + 40)[0]
    fname_len = struct.unpack_from("<H", data, offset + 56)[0]
    fname_offset = struct.unpack_from("<H", data, offset + 58)[0]

    fname_bytes = data[offset + fname_offset : offset + fname_offset + fname_len]
    file_name = fname_bytes.decode("utf-16le", errors="replace")

    active_reasons = [name for bit, name in USN_REASONS.items() if reason_code & bit]

    rec = USNRecord(
        usn=usn,
        timestamp_utc=parse_filetime(filetime_raw),
        file_name=file_name,
        mft_entry_id=file_ref & 0xFFFFFFFFFFFF,
        parent_entry_id=parent_ref & 0xFFFFFFFFFFFF,
        reasons=active_reasons
    )
    return rec, offset + record_len

if __name__ == "__main__":
    # Synthetic binary USN record for testing
    fname = "confidential_source_code.7z".encode("utf-16le")
    header = struct.pack("<IHHQQQQIIIIHH", 60 + len(fname), 2, 0, 105234, 4521, 98234120, 133500000000000000, 0x00000102, 0, 0, 0, len(fname), 60)
    synthetic_payload = header + fname
    rec, next_off = parse_usn_v2_record(synthetic_payload, 0)
    if rec:
        print(f"Parsed USN Record:\n{json.dumps(asdict(rec), indent=2)}")

Automated forensic parsing correlates file events with active user sessions, providing courtroom-ready evidence that withstands scrutiny in civil litigation and criminal prosecutions.

5. Conclusion & Key Takeaways

Correlating Windows Event Logs with the NTFS USN Change Journal provides forensic examiners with an unshakeable, multi-dimensional timeline of unauthorized access. While attackers can tamper with user-mode logs or modify superficial timestamps, the underlying kernel-level file transactions recorded in the USN Journal preserve the truth, enabling defensible incident response and successful legal prosecution.

Key strategic takeaways for forensic examiners, incident responders, and trial lawyers include:

1. Correlate EVTX with USN: Combine high-level user session IDs with low-level NTFS file creation/deletion timestamps.
2. Track Critical Security Event IDs: Monitor Events 4624 (Logon Types 2/3/10), 4688 (Process CLI), and 7045 (Service Installs).
3. Decode USN Reason Bitmasks: Use FILE_CREATE, DATA_EXTEND, and FILE_DELETE to track file staging and data wiping.
4. Defeat Anti-Forensics: Recover deleted USN entries from unallocated space to expose log clearing and timestomping.
5. Preserve Raw System Streams: Capture bitstream volume images (E01) to acquire $Extend\\$UsnJrnl:$J defensibly.
6. Track LOLBins & Scripting: Monitor PowerShell Event 4104 to capture de-obfuscated in-memory execution payloads.
7. Identify Lateral Movement: Analyze Kerberos Events 4768 and 4769 to detect Pass-the-Ticket and Kerberoasting attacks.
8. Reconstruct Complete File Paths: Traverse ParentFileReferenceNumber trees to identify the exact directories accessed.
9. Expose Exfiltration Staging: Flag rapid clusters of DATA_EXTEND events on compressed archives in temporary directories.
10. Validate with MFT Sequence Numbers: Use 16-bit sequence numbers to confirm whether newly created files reused deleted MFT slots.
11. Maintain Forensic Chain of Custody: Calculate SHA-256 hashes of all exported EVTX and USN stream containers.
12. Automate Triage Extraction: Deploy non-destructive scripts to capture volatile event logs and journal metadata during initial response.

6. Frequently Asked Questions (FAQ)