fsutil usn

Manages the update sequence number (USN) change journal. The USN change journal provides a persistent log of all changes made to files on the volume. As files, directories, and other NTFS objects are added, deleted, and modified, NTFS enters records into the USN change journal, one for each volume on the computer. Each record indicates the type of change and the object changed. New records are appended to the end of the stream.

fsutil usn [createjournal] m=<maxsize> a=<allocationdelta> <volumepath>

fsutil usn [deletejournal] {/d | /n} <volumepath>

fsutil usn [enablerangetracking] <volumepath> [options]

fsutil usn [enumdata] <fileref> <lowUSN> <highUSN> <volumepath>

fsutil usn [queryjournal] <volumepath>

fsutil usn [readdata] <filename>

fsutil usn [readjournal] [c= <chunk-size> s=<file-size-threshold>] <volumepath>

fsutil usn createjournal m=1000 a=100 c:

fsutil usn deletejournal /d c:

fsutil usn enablerangetracking c=16384 s=67108864 C:

fsutil usn enumdata 1 0 1 c:

fsutil usn queryjournal c:

Show 21 options

createjournalCreates a USN change journal.

m=<maxsize>Specifies the maximum size, in bytes, that NTFS allocates for the change journal.

a=<allocationdelta>Specifies the size, in bytes, of memory allocation that is added to the end and removed from the beginning of the change journal.

<volumepath>Specifies the drive letter (followed by a colon).

deletejournalDeletes or disables an active USN change journal. CAUTION: Deleting the change journal impacts the File Replication Service (FRS) and the Indexing Service, because it requires these services to perform a complete (and time-consuming) scan of the volume. This in turn negatively impacts FRS SYSVOL replication and replication between DFS link alternates while the volume is being rescanned.

/dDisables an active USN change journal, and returns input/output (I/O) control while the change journal is being disabled.

/nDisables an active USN change journal and returns I/O control only after the change journal is disabled.

enablerangetrackingEnables USN write range tracking for a volume.

c=<chunk-size>Specifies the chunk size to track on a volume.

s=<file-size-threshold>Specifies the file size threshold for range tracking.

enumdataEnumerates and lists the change journal entries between two specified boundaries.

<fileref>Specifies the ordinal position within the files on the volume at which the enumeration is to begin.

<lowUSN>Specifies the lower boundary of the range of USN values used to filter the records that are returned. Only records whose last change journal USN is between or equal to the lowUSN and highUSN member values are returned.

<highUSN>Specifies the upper boundary of the range of USN values used to filter the files that are returned.

queryjournalQueries a volume's USN data to gather information about the current change journal, its records, and its capacity.

readdataReads the USN data for a file.

<filename>Specifies the full path to the file, including the file name and extension For example: C:\documents\filename.txt.

readjournalReads the USN records in the USN journal.

minver=<number>Minimum Major Version of USN_RECORD to return. Default = 2.

maxver=<number>Maximum Major Version of USN_RECORD to return. Default = 4.

startusn=<USN number>USN to start reading the USN journal from. Default = 0.