Usecase: Can be used to forensically erase a file
Privileges required: User
OS: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10
MITRE ATT&CK®: T1485
Delete the USN journal volume to hide file creation activity
fsutil.exe usn deletejournal /d c:
Usecase: Can be used to hide file creation activity
Privileges required: User
OS: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10
MITRE ATT&CK®: T1485