默认情况下是否禁用USN日记？

Question

In my backup application I am using USN journal to check changes to the volume. By default USN is disabled or enabled? In this link (old article)it was mentioned like "By default, an NTFS volume will have its Change Journal disabled" .I didn't get much information about it in any website. Is it really disabled on NTFS drive or Is it based on OS? It's important to me because I use it in my application.

Answer 1

It's generally on in Windows XP, Vista, 7, 8, Server 2003, Server 2008, and Server 2012. But, I've seen it off in each and every one of these version, so you can't rely on it just being on. I've seen articles and q/a where users are told to delete it to save space. You can query whether it's off or on here .

You can turn it off and on (or grow it) here .

The article you've referenced is an oldie but a goody. Windows 2000 was the brave new world when that was written.

There is also a tool called fsUtil available in Windows XP,Vista, 7, 8, Server 2003, Server 2008, and Server 2012 that will let you query the USN journal, turn it off/on, and grow it from the command line.

Answer 2

I think it's disabled by default, because it consumes resources, and if nobody needs the journal, then it would be a waste. Anyway, the real answer is that you can't depend on this knowledge. It may be dependent on many of things. Even if there is a default, any user may have enabled/disabled the journal manually. If you depend on the journal, then you have to check if it's enabled, and if not, then enable it.