USN option working inconsistently

Hi all – I’m the original author of the USN feature, and I’m also observing failures on Windows 10. After some investigation, I believe it’s due to a new Windows 10 feature, the “$Extend$Deleted” folder (The “\$Extend\$Deleted” directory – My DFIR Blog).

I just want to let you know that I’m looking into this, trying to add support for files that have been “moved” to that folder.

2 Likes