Process
fsutil.exe
fsutil.exe is a file system utility for low-level NTFS and volume tasks. Administrators use it for disk and file system maintenance. Attackers use it for anti-forensics, most notably deleting the USN change journal that records file activity, and to wipe or manipulate files.
File identity
Not observed.
Not observed.
Not observed.
Not observed.
Execution context
Not observed.
Not observed.
Not observed.
Not observed.
Not observed.
Not observed.
Ancestry
Not observed.
Not observed.
Not observed.
Not observed.
Behavior
Not observed.
Not observed.
Not observed.
Not observed.
fsutil.exe file setZeroData offset=0 length=9999999999 {PATH_ABSOLUTE}Tamper · Can be used to forensically erase a filefsutil.exe usn deletejournal /d c:Tamper · Can be used to hide file creation activityfsutil.exe trace decodeExecute · Spawn a pre-planted executable from fsutil.exe.
Indicators
Not observed.
Analysis
fsutil.exe performs file system operations that ordinary tools do not expose: querying and setting volume and NTFS properties, managing hardlinks and reparse points, working with sparse files, and managing the USN change journal that NTFS keeps of file changes. It requires administrative rights and lives at C:\Windows\System32\fsutil.exe.
Legitimately, fsutil is run by administrators for disk diagnostics and configuration, which is infrequent. The sub-command it runs is what gives an instance meaning.
fsutil.exe is an anti-forensics tool (T1070.004). fsutil usn deletejournal /d C: deletes the USN change journal, the NTFS record of which files were created, modified, and deleted, removing a timeline investigators rely on. Run next to event-log clearing and shadow-copy deletion, it is part of a deliberate effort to erase the trail.
Its low-level file operations also support data destruction (T1485): verbs that zero or overwrite file data can be used to wipe specific files beyond recovery. Because fsutil is a legitimate maintenance tool, the sub-command, the target, and the parent are what separate disk administration from evidence destruction.
- Image path other than
C:\Windows\System32\fsutil.exehigh usn deletejournal(destroying the NTFS change journal)highfile setZeroDataor similar used to overwrite file contentshigh- Parent is
cmd.exe,powershell.exe, or an unfamiliar processhigh - Run alongside event-log clearing or shadow-copy deletionmed
Telemetry
Not observed.
Not observed.