FSUTIL USN

Manages the update sequence number (USN) change journal, which provides a persistent log of all changes made to files on the volume. As files, directories, and other NTFS objects are added, deleted, and modified, NTFS enters records into the USN change journal, one for each volume on the computer. Each record indicates the type of change and the object changed. New records are appended to the end of the stream.

Programs can consult the USN change journal to determine all the modifications made to a set of files. The USN change journal is much more efficient than checking time stamps or registering for file notifications. The USN change journal is enabled and used by the Indexing Service, File Replication Service (FRS), Remote Installation Service (RIS), and Remote Storage.

FSUTIL USN help

FSUTIL USN createjournal m=max_size a=alloc_size drive

FSUTIL USN deletejournal [/D | /N] drive

FSUTIL USN enumdata fileref usnlow usnhigh drive

FSUTIL USN queryjournal drive

FSUTIL USN readdata file_name

a=alloc_size (NTXP)

Specifies the size, in bytes, of memory allocation that is added to the end and removed from the beginning of the change journal.

The change journal can grow to more than the sum of the values of max_size and alloc_size before being trimmed.

createjournal (NTXP)

Creates a USN change journal.

If a change journal already exists on a volume, updates the change journal's max_size and alloc_size. This allows you to expand the number of records that an active journal maintains without having to disable it. If you specify zero for max_size and alloc_size, the system chooses a default value based on the volume size.

deletejournal (NTXP)

Deletes or disables an active USN change journal.

Deleting or disabling an active journal is very time consuming, because the system must access all the records in the master file table (MFT) and set the last USN attribute to zero. This process can take several minutes, and can continue after the system restarts, if necessary. During this process, the change journal is not considered active, nor is it disabled. While the system is disabling the journal, it cannot be accessed, and all journal operations return errors. You should use extreme care when disabling an active journal, because it adversely affects other applications using the journal.

drive (NTXP)

Specifies the drive letter (followed by a colon), mount point, or volume name.

enumdata (NTXP)

Enumerates and lists the change journal entries between two specified boundaries.

file_name (NTXP)

Specifies the drive letter (followed by a colon), mount point, or volume name.

(NT2003)

Specifies the full path to the file including the file name and extension.

fileref (NTXP)

Ordinal position within the files on the volume at which the enumeration is to begin.

help (NTXP)

Display help.

m=max_size (NTXP)

Specifies the maximum size, in bytes, that NTFS allocates for the change journal.

The change journal can grow larger than this target value, but the change journal is truncated at the next NTFS checkpoint to less than this value. NTFS examines the change journal and trims it when its size exceeds the value of max_size plus the value of alloc_size. At NTFS checkpoints, the operating system writes records to the NTFS log file that allow NTFS to determine what processing is required to recover from a failure.

queryjournal (NTXP)

Queries a volume's USN data to gather information about the current change journal, its records, and its capacity.

readdata (NTXP)

Read the USN data for a file.

usnhigh (NTXP)

Upper boundary of the range of USN values used to filter which files are returned.

usnlow (NTXP)

Lower boundary of the range of USN values used to filter which records are returned. Only records whose last change journal USN is between or equal to the usnlow and usnhigh member values are returned.

/D (NTXP)

Disables an active USN change journal, and returns I/O control while the change journal is being disabled.

/N (NTXP)

Disables an active USN change journal and returns I/O control only after the change journal is disabled.

FSUTIL BEHAVIOR
FSUTIL DIRTY
FSUTIL FILE
FSUTIL FSINFO
FSUTIL HARDLINK
FSUTIL OBJECTID
FSUTIL QUOTA
FSUTIL REPARSEPOINT
FSUTIL SPARSE
FSUTIL VOLUME

none.

none.

none.

External

DOS

none

Windows

none

Windows NT

NTXP NT2003