Disable NTFS USN journal Windows 11

Disable NTFS USN journal Windows 11

Click for full size

C:\$extend\$Usn.Jrnl:$J:$data

Here is a picture finally. The large strip in the center of the top band is the largest chunk, in the other, grey areas are the various clusters with it.

On the right, the big long grey line is $logfile (not paging), and it is 63 MB. Paging, 500 MB is the dark cyan chunk, next to the yellow MFTres in the inner rings.. The disk was defragged so they could be seen easier. Not all clusters of this type of file are tagged, but the idea is there.

The disk is 4k clusters, now about 12 GB size. Each cute little block in the picture is .81 MB and represents 207 clusters. The dkGreen section, is mostly the whole Winsxs pile, also interesting when they keep telling us it doesn't take much disk space.

Wikipedia suggests that in previous NT systems "USN journaling" would be turned on when enabled (assumes it could also be turned off?).

What aspects, services, or program is working on putting that stuff all over the disk which is known by $jrnl$ type clusters, even if it is not actual USN journaling?

Is it possible in a Windows 7 system to completly disable the journaling, and what would be the ramifications of that?

On a Windows XP NTFS system, I do not recall seeing the quantity of disk clusters used with these $jrnl$ names, so I do not recall this being necessary in this quantity for an NTFS file system itself?

I understand that it would not be there, if it did not have a useful function :-) Information about how wonderful is fine, if that information will help track down what parts of the system create and use it.

Change Journals states:

Change journals are also needed to recover file system indexing

Hmm, that might explain some of them, or why it was left on the disk. A crash while background indexing?

  1. Home
  2. News
  3. Computing

Disable NTFS USN journal Windows 11

(Image credit: Microsoft)

Windows 11 continues to run into trouble with drive speeds being seriously hampered, as more users are being affected by a previously flagged issue than was first thought – this isn’t just about NVMe SSDs it seems – but the better news is that Microsoft has a (hopefully imminent) fix in the pipeline.

Earlier this week, we reported on the problem with NVMe SSDs running over 50% slower in some cases with write speeds, but as noted, it turns out that this nasty storage flaw affects all disks, as Microsoft has recently admitted (as spotted by Windows Latest (opens in new tab), which points out the problem has been observed across all sorts of online forums).

On November 22, Microsoft pushed out a cumulative update in preview, KB5007262, and under the listed fixes, a cure for this issue is present noting that it affects all types of storage medium.

Microsoft said (opens in new tab) that KB5007262 “addresses an issue that affects the performance of all disks (NVMe, SSD, hard disk) on Windows 11 by performing unnecessary actions each time a write operation occurs. This issue occurs only when the NTFS USN journal is enabled. Note, the USN journal is always enabled on the C: disk.”

As this is an optional (preview) update, you have to manually install it, and as with anything which is still officially in testing, it may also cause problems as well as solve them.

The best course of action at this point is likely to wait, because this preview update arrived a few weeks back now, and the full (finalized) cumulative update will be available for Windows 11 users on Patch Tuesday for this month, which is this coming Tuesday, December 14.


Analysis: A chance to turn over a new leaf squandered

This is another of those alarming bugs which have blighted Windows 11, and made it an unpleasant experience performance-wise for a number of users. It’s worrying to learn that it affects all types of SSDs and even hard disks as well, considering how much of a speed reduction can be caused by the problem, but at least we know that the resolution is (theoretically) just around the corner now.

Windows 11 has also witnessed a number of serious issues around performance on the desktop with File Explorer, and this is such a fundamental piece of the interface that it’s another very concerning facet of what seems to be misfiring QA (quality assurance) at Microsoft.

That isn’t a new thing, and we’ve got used to this state of affairs with Windows 10, sadly. But it’s something we hoped might be rectified, given that Windows 11 could have been a new leaf for the software giant – but Microsoft certainly hasn’t got off on the right foot here, bug-wise. Indeed, these performance problems with drives and the UI were in evidence before Windows 11 was even released, so it’s not like Microsoft hasn’t had some time to get things right.

Clearly, the drive issue was a thorny problem, and it’s better late than never with the fix – but we won’t stop banging the drum that Microsoft needs to do better when it comes to keeping its desktop operating systems in more bug-free shape than this.

  • Find out where to buy Windows 10

Darren is a freelancer writing news and features for TechRadar (and occasionally T3) across a broad range of computing topics including CPUs, GPUs, various other hardware, VPNs, antivirus and more. He has written about tech for the best part of three decades, and writes books in his spare time (his debut novel - 'I Know What You Did Last Supper' - was published by Hachette UK in 2013).

Can I delete USN journal?

Deleting or disabling an active change journal is very time consuming, because the system must access all the records in the master file table (MFT) and set the last USN attribute to 0 (zero). This process can take several minutes, and it can continue after the system restarts, if a restart is necessary.

Does Windows 11 cause performance issues?

Microsoft Confirms Windows 11 2022 Update Causes Performance Issues When Copying Large Files. Microsoft has confirmed a new issue that is currently affecting PCs running the Windows 11 2022 Update (or version 22H2).

What is chkdsk is verifying USN journal?

The USN journal check is a standard part of that process. The fact that it is doing it is simply an indication that it is on step 3 o the process. If the CHKDSK was system initiated, it probably means there is some corruption on the hard drive.

What is UsnJrnl :$ J?

By default Windows maintains a journal of filesystem activities is a file called $Extend\$UsnJrnl in a special data stream called $J. This stream contains records of filesystem operations, primarily to allow backup applications visibility into the files that have been changed since the last time a backup was run.