① On an NTFS volume, file and directory information is
stored in the Master File Table (MFT).
② With NTFS 5.0, each file's MFT entry records the Last
USN generated for that file.
③ Whenever the file system makes a change to a file or
directory, it appends a record to the journal. The
record identifies the file name, the time of the change,
and what type of change occurred.
CHANGE JOURNAL ON NTFS 5.0