Under Windows 2000, NTFS 3.0 partitions can be set to keep track of changes to files and directories on the volume, providing a record of when and what was done to the various objects.
When enabled, the system records all changes made to the volume in the USN Journal, which is the name also used to describe the feature itself.
Whenever a change is made to the volume, a record is added to the file.
For this reason the Change Journal cannot be used to undo operations on files within NTFS.
[3] The desktop search utility Everything monitors the journal to update its database of file names.