[jhoechtl]

what about deleted files? Do they eventually get flushed from the cache?

[wander_homer]

Files get deleted immediately, the USN Journal only keeps track of the events (including delete events). It's basically a log of all filesystem events (up until a certain point in time, due to size restrictions).

[Someone]

The journal has data about deletions, too.

https://learn.microsoft.com/en-us/windows-server/administrat...:

“As files, directories, and other NTFS objects are added, deleted, and modified, NTFS enters records into the USN change journal, one for each volume on the computer.”