Parser for $UsnJrnl on NTFS