Which NTFS component records changes to files over time, aiding timeline reconstruction?

Which NTFS component records changes to files over time, aiding timeline reconstruction?

• A. MFT
• B. $LogFile
• C. USN Journal
• D. $Secure

Answer: (C)

The NTFS component that records changes to files over time for timeline reconstruction is the USN Journal. It acts as a Change Journal for the volume, logging every update to files and directories, including creations, deletions, modifications, renames, and attribute changes. Each entry carries a sequence number (the USN), a timestamp, the file reference, and a reason code describing what happened. That structured, chronological log lets you trace how a file or the whole filesystem evolved over time, which is exactly what a forensic timeline needs. The other options aren’t designed for this purpose. The Master File Table stores current metadata and locations for files, not a history of changes. The NTFS transaction log ($LogFile) supports crash recovery by recording ongoing operations, not a complete long-term history for timeline reconstruction. The $Secure store security descriptors, not change events.

The NTFS component that records changes to files over time for timeline reconstruction is the USN Journal. It acts as a Change Journal for the volume, logging every update to files and directories, including creations, deletions, modifications, renames, and attribute changes. Each entry carries a sequence number (the USN), a timestamp, the file reference, and a reason code describing what happened. That structured, chronological log lets you trace how a file or the whole filesystem evolved over time, which is exactly what a forensic timeline needs.

The other options aren’t designed for this purpose. The Master File Table stores current metadata and locations for files, not a history of changes. The NTFS transaction log ($LogFile) supports crash recovery by recording ongoing operations, not a complete long-term history for timeline reconstruction. The $Secure store security descriptors, not change events.