How to Use the fsutil usn Command in Windows 11 to Query and Manage the NTFS Change Journal

Underneath the Windows 11 operating system, the NTFS file system records every file modification, directory creation, deletion, and permission update in a high-performance system log known as the USN (Update Sequence Number) Change Journal. Critical Windows services—including Windows Search Indexer, File History, antivirus filter drivers, and backup applications—rely heavily on the USN Journal to detect file modifications instantly without scanning millions of files across storage volumes.

However, when backup software encounters synchronization corruption, or when the journal consumes excessive reserved storage space on SSDs, administrators need to query its health or reset its tracking records. Windows 11 provides the native fsutil usn command to inspect, configure, and manage Change Journals directly from an elevated prompt. This guide covers essential commands and system administration workflows.

Opening Elevated Terminal in Windows 11

Manipulating volume journal headers requires administrative security privileges:

1. Press Win + X and select Terminal (Admin).
2. Ensure PowerShell or Command Prompt opens with administrative privileges.

Core USN Journal Commands

1. Querying Change Journal Status

To inspect whether the Change Journal is currently active on volume C: and check its allocated boundaries:

fsutil usn queryjournal C:

The command returns vital metadata, including the Usn Journal ID, Lowest Usn, Next Usn, and maximum allocated byte thresholds.

2. Reading Recent Change Records in Real Time

To inspect live file events being committed to the volume:

fsutil usn readjournal C: csv

The csv modifier outputs comma-separated records containing exact timestamps, Reason Codes (e.g. FILE_CREATE, DATA_EXTEND, CLOSE), and File Reference Numbers.

3. Deleting and Resetting a Corrupted Journal

If enterprise backup tools report that the Change Journal has wrapped unexpectedly or encountered read corruption, delete and reinitialize the journal on that volume:

fsutil usn deletejournal /D C:

The /D flag marks the journal inactive and returns its allocated space back to the NTFS free cluster pool. Windows will automatically re-create a clean journal instance when indexing services restart.

4. Creating and Sizing the Journal

To manually create or adjust the storage thresholds of the USN journal on a dedicated storage drive (e.g. drive D:):

# Syntax: fsutil usn createjournal <MaxSizeInBytes> <AllocationDeltaInBytes> <Volume>
fsutil usn createjournal 67108864 8388608 D:

This configures a 64MB journal cap with 8MB allocation increments, preventing fragmentation on heavy I/O volumes.

Key USN Reason Codes Reference

Reason Code Flag	System Action	Significance
0x00000001	USN_REASON_DATA_OVERWRITE	User or application modified existing file contents
0x00000002	USN_REASON_DATA_EXTEND	File size increased due to appended data
0x00000100	USN_REASON_FILE_CREATE	New file created in directory
0x00000200	USN_REASON_FILE_DELETE	File permanently removed from MFT table
0x80000000	USN_REASON_CLOSE	File handle closed; all changes committed to disk