winEVTViewer Command-line viewer for Windows Change (USN) Journal records ($Extend$UsnJrnl:$J). See also: mkucenski/libWinUsnJrnl