Journal Analysis (JournalTrace / Echo Easy Journal Viewer)

Analyzing the NTFS USN Journal is a powerful technique for understanding the history of file system activity on a volume, often revealing actions that other artifacts might miss, especially deletions and renames.