/// <summary> /// DeleteUsnJournal() deletes a USN journal on the volume. If no USN journal exists, this /// function simply returns success. /// </summary> /// <param name="journalState">USN_JOURNAL_DATA object for this volume</param> /// <returns>a UsnJournalReturnCode /// USN_JOURNAL_SUCCESS DeleteUsnJournal() function succeeded. /// VOLUME_NOT_NTFS volume is not an NTFS volume. /// INVALID_HANDLE_VALUE NtfsUsnJournal object failed initialization. /// USN_JOURNAL_NOT_ACTIVE USN journal is not active on volume. /// ERROR_ACCESS_DENIED accessing the USN journal requires admin rights, see remarks. /// ERROR_INVALID_FUNCTION error generated by DeviceIoControl() call. /// ERROR_FILE_NOT_FOUND error generated by DeviceIoControl() call. /// ERROR_PATH_NOT_FOUND error generated by DeviceIoControl() call. /// ERROR_TOO_MANY_OPEN_FILES error generated by DeviceIoControl() call. /// ERROR_INVALID_HANDLE error generated by DeviceIoControl() call. /// ERROR_INVALID_DATA error generated by DeviceIoControl() call. /// ERROR_NOT_SUPPORTED error generated by DeviceIoControl() call. /// ERROR_INVALID_PARAMETER error generated by DeviceIoControl() call. /// ERROR_JOURNAL_DELETE_IN_PROGRESS USN journal delete is in progress. /// ERROR_INVALID_USER_BUFFER error generated by DeviceIoControl() call. /// USN_JOURNAL_ERROR unspecified USN journal error. /// </returns> /// <remarks> /// If function returns ERROR_ACCESS_DENIED you need to run application as an Administrator. /// </remarks> public int DeleteUsnJournal(USN_JOURNAL_DATA_V0 journalState) { var lastError = (int)UsnJournalReturnCode.VOLUME_NOT_NTFS; if (_isNtfsVolume) { if (_usnJournalRootHandle.ToInt64() != Win32Api.INVALID_HANDLE_VALUE) { var dujd = new DELETE_USN_JOURNAL_DATA { UsnJournalID = journalState.UsnJournalID, DeleteFlags = (uint)UsnJournalDeleteFlags.USN_DELETE_FLAG_DELETE }; var sizeDujd = Marshal.SizeOf(dujd); var dujdBuffer = Marshal.AllocHGlobal(sizeDujd); Win32Api.ZeroMemory(dujdBuffer, sizeDujd); Marshal.StructureToPtr(dujd, dujdBuffer, true); Win32Api.DeviceIoControl(_usnJournalRootHandle, Win32Api.FSCTL_DELETE_USN_JOURNAL, dujdBuffer, sizeDujd, IntPtr.Zero, 0, out _, IntPtr.Zero); lastError = Marshal.GetLastWin32Error(); Marshal.FreeHGlobal(dujdBuffer); } else { lastError = (int)UsnJournalReturnCode.INVALID_HANDLE_VALUE; } } return(lastError); }
public void Delete() { var deletionData = new DELETE_USN_JOURNAL_DATA { UsnJournalID = Data.ID, DeleteFlags = DeletionFlag.WaitUntilDeleteCompletes, }; Win32DeviceControl.ControlWithInput(ChangeJournalHandle, Win32ControlCode.CreateUsnJournal, ref deletionData, 0); ReadJournalData(); }