USN Change Journal And Sophos

  • Article ID: 43898
  • Rating:
  • 2 customers rated this article 4.0 out of 6
  • Updated: 05 Dec 2014


Certain backup and indexing software use the 'Change Journal' or 'Update Sequence Number (USN) change journal' to determine which files need to be backed up:

This can affect certain backup and indexing software that uses the USN change journal, as any file or files accessed by Sophos Anti-Virus can trigger a backup or re-index.

First seen in
Sophos Anti-Virus for Windows 2000+


Sophos Anti-Virus, prior to version 10.3 resets the "last time/date modified" value on a file, which is recorded in the USN change journal as a reset.

What To Do 

To prevent the alteration of the 'last time/date modified' value a registry value can be applied:

  1. Before you start ensure that you have read the warnings about editing the registry
  2. Create a registry value:
    • 32-bit: HKLM\SOFTWARE\Sophos\SAVService\Application\ ODScanUpdateMetadata (DWORD) value 0
    • 64-bit:HKLM\SOFTWARE\Wow6432Node\Sophos\SAVService\Application\ ODScanUpdateMetadata (DWORD) value 0

The default value used by Sophos when this registry entry is not set is 1 - update last time stamp.

If you need more information or guidance, then please contact technical support.

Rate this article

Very poor Excellent