/// <summary><see cref="http://msdn.microsoft.com/en-us/library/windows/desktop/aa364563(v=vs.85).aspx"/></summary>
public IUSN_RECORD[] FileSystemEnumUsnData()
{
ulong nextUsn = 0;
const int chunkSize = 1 * 1024 * 1024; // 1 MB chunks
List <IUSN_RECORD> res = new List <IUSN_RECORD>();
using (UnmanagedMemory mem = new UnmanagedMemory(chunkSize))
{
do
{
MFT_ENUM_DATA_V0 input = new MFT_ENUM_DATA_V0();
input.StartFileReferenceNumber = nextUsn;
input.LowUsn = long.MinValue;
input.HighUsn = long.MaxValue;
int errorCode;
byte[] data = DeviceIoControlHelper.InvokeIoControl(Handle, IOControlCode.FsctlEnumUsnData, chunkSize, input, out errorCode);
Marshal.Copy(data, 0, mem, data.Length);
if (errorCode != 0)
{
// Exit when theres no more to do
break;
}
nextUsn = BitConverter.ToUInt64(data, 0);
int dataOffset = 8;
while (dataOffset < data.Length)
{
int length;
IUSN_RECORD rec = ParseUsnRecord(mem, dataOffset, out length);
if (length <= 0)
{
break;
}
res.Add(rec);
// Move to next record
dataOffset += length;
}
// Fetch next chunk
} while (true);
}
return(res.ToArray());
}
/// <summary><see cref="https://msdn.microsoft.com/en-us/library/windows/desktop/aa364586(v=vs.85).aspx"/></summary>
public IUSN_RECORD[] FileSystemReadUsnJournal(long volumeJournalId, UsnJournalReasonMask reasonMask, USN firstUsn, int bytesToWaitFor = 0, int timeout = 0)
{
READ_USN_JOURNAL_DATA_V0 input = new READ_USN_JOURNAL_DATA_V0();
input.StartUsn = firstUsn;
input.UsnJournalId = volumeJournalId;
input.ReasonMask = reasonMask;
input.BytesToWaitFor = bytesToWaitFor;
input.Timeout = timeout;
int errorCode;
byte[] data = DeviceIoControlHelper.InvokeIoControl(Handle, IOControlCode.FsctlReadUsnJournal, 1024 * 1024, input, out errorCode);
List <IUSN_RECORD> res = new List <IUSN_RECORD>();
using (UnmanagedMemory mem = new UnmanagedMemory(data))
{
int dataOffset = 8;
while (dataOffset < data.Length)
{
int length;
IUSN_RECORD rec = ParseUsnRecord(mem, dataOffset, out length);
if (length <= 0)
{
break;
}
res.Add(rec);
// Move to next record
dataOffset += length;
}
}
return(res.ToArray());
}
