The journal has data about deletions, too. https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn https://learn.microsoft.

The journal has data about deletions, too. https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn https://learn.microsoft.com/en-us/windows-server/administrat...: “As files, directories, and other NTFS objects are added, deleted, and modified, NTFS enters records into the USN change journal, one for each volume on the computer.”