NTFS USN Journal and ObjectID
Note:I translated Japanese into English using Google Translate.
Thank you, Google.
Enable USN Journal on sample NTFS volumes and Copy Example.jpg to the Pictures folder.
Check the status of ObjectID, ObjectID is not set.
Using USN Analytics, parse $J and check the USN journal record.
Open the Example.jpg file from the Photos application.
The ObjectID is set by the operation that opened the file. (Create LNK file in Recent folder)
You can confirm that USN_REASON_OBJECT_ID_CHANGE is recorded in the USN Journal.
Delete the ObjectID.
USN Journal will record USN_REASON_OBJECT_ID_CHANGE, but I can not identify that it was deleted.
USN Analytics will output records containing ObjectID to usn_analytics_opened.csv.
<2018/8/26 added>
It explains the ObjectID when the file is not opened.
This video is very helpful.
</add>
by the way,
The author(@4n6ist) of USN Analytics is the #OSDFcon speaker.
I am looking forward to his new presentation!!
Reference URL:
https://www.jpcert.or.jp/present/2018/JSAC2018_03_yamazaki.pdf
