drop usn journal csv or ntfs logfile csv · detect gaps in journal sequence numbers · identify windows where filesystem activity was not recorded · surface journal clearing or rollover events · runs locally
journal csv
drop usn / logfile csv
or click
usn from fsutil / velociraptor / mftecmd $J · logfile from ntfs log parser · optional registry journal config csv
drop usn journal csv or ntfs logfile csv — multiple files ok