Hacker News new | ask | show | jobs
by Someone 1066 days ago
The journal has data about deletions, too.

https://learn.microsoft.com/en-us/windows-server/administrat...:

“As files, directories, and other NTFS objects are added, deleted, and modified, NTFS enters records into the USN change journal, one for each volume on the computer.”