CHFI Storage Forensics and File System Analysis Practice Question
During a forensic examination of a Windows 10 system, an investigator runs the following command: 'fsutil usn readjournal C: > usn_output.txt'. What is the primary purpose of this action?
⚠ Common exam trap
The CHFI exam often tests the distinction between the USN journal (which logs changes) and the $MFT (which stores file metadata), causing candidates to confuse reading the journal with extracting the MFT.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To analyze the Update Sequence Number (USN) journal for file system activity
The `fsutil usn readjournal` command reads the Update Sequence Number (USN) journal, which is a change journal that records all modifications to files and directories on an NTFS volume. This is the primary purpose of the command, as it allows an investigator to analyze file system activity, including file creations, deletions, and modifications, which is critical for forensic timeline reconstruction.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To recover deleted files from the Recycle Bin
Why it's wrong here
The fsutil usn readjournal command queries the NTFS USN journal, which is a change log of file system modifications, not a repository for deleted file contents. Recovering items from the Recycle Bin would require parsing the $Recycle.bin directory and selecting files based on their $I metadata files. While the journal may reveal that a deletion occurred, it never stores the original file data, so it cannot aid in recovering deleted files themselves.
- ✓
To analyze the Update Sequence Number (USN) journal for file system activity
Why this is correct
The fsutil usn readjournal command reads the Update Sequence Number (USN) journal, a Microsoft NTFS feature that records a high-level log of all file and directory changes, including creation, deletion, and attribute updates. This makes it an excellent source for identifying file system activity during a forensic investigation, as the journal entry contains the file reference, change reason, and timestamp. Using the optional /v (verbose) flag reveals additional detail about each USN_RECORD, such as the file name and the actual reason flags set for the change.
- ✗
To check the integrity of the NTFS file system
Why it's wrong here
NTFS integrity checking is performed by the chkdsk utility, which scans the volume for errors in the file system metadata, bad sectors, and structural problems. The USN journal, on the other hand, is an append-only log of change records and does not perform any validation or repair functions. Running fsutil usn readjournal will only output the content of the change journal to stdout; it will not test the health or consistency of the NTFS volume.
- ✗
To extract the Master File Table ($MFT) from the volume
Why it's wrong here
The Master File Table ($MFT) is a critical NTFS system file containing a record for every file and directory on the volume, and extracting it forensically typically requires a tool like FTK Imager or the ntfsinfo utility from The Sleuth Kit. The fsutil usn readjournal command targets the \$Extend\$UsnJrnl file, which is a change journal used to track modifications; it is separate from the $MFT. While the journal references files via their MFT file reference number, it does not expose the MFT records themselves.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 745 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.