/// <summary>
/// Retrieves a USN_RECORD_V2 by file reference number (FRN, not USN!)
/// </summary>
/// <param name="frn">File reference number</param>
/// <returns>Returned entry if successful; null otherwise</returns>
private Record GetRecordByFileRef(ulong frn)
{
var enumData = new Win32USN.MFT_ENUM_DATA
{
StartFileReferenceNumber = frn,
LowUsn = 0,
HighUsn = m_journal.NextUsn
};
var bufferSize = 512;
byte[] entryData;
while (!Win32USN.ControlWithInput(m_volumeHandle, Win32USN.FsCtl.EnumUSNData,
ref enumData, bufferSize, out entryData))
{
var e = Marshal.GetLastWin32Error();
if (e != Win32USN.ERROR_INSUFFICIENT_BUFFER)
{
return(null);
}
// retry, increasing buffer size
bufferSize *= 2;
}
// not really a foreach: we only check the first record
foreach (var rec in EnumerateRecords(entryData))
{
if (rec.UsnRecord.FileReferenceNumber == frn)
{
return(rec);
}
break;
}
return(null);
}
/// <summary>
/// Returns collection of USN records, starting at startUSN
/// </summary>
/// <param name="startUsn">The USN number to start the list from, set to zero to get all</param>
/// <returns>A list of files and folders changed since the USN</returns>
private ICollection <Record> GetRawRecords(long startUsn)
{
var records = new List <Record>();
var readData = new Win32USN.READ_USN_JOURNAL_DATA_V0
{
StartUsn = Math.Max(startUsn, m_journal.LowestValidUsn),
ReasonMask = Win32USN.USNReason.USN_REASON_BASIC_INFO_CHANGE |
Win32USN.USNReason.USN_REASON_DATA_EXTEND |
Win32USN.USNReason.USN_REASON_DATA_OVERWRITE |
Win32USN.USNReason.USN_REASON_DATA_TRUNCATION |
Win32USN.USNReason.USN_REASON_EA_CHANGE |
Win32USN.USNReason.USN_REASON_FILE_CREATE |
Win32USN.USNReason.USN_REASON_FILE_DELETE |
Win32USN.USNReason.USN_REASON_HARD_LINK_CHANGE |
Win32USN.USNReason.USN_REASON_NAMED_DATA_EXTEND |
Win32USN.USNReason.USN_REASON_NAMED_DATA_OVERWRITE |
Win32USN.USNReason.USN_REASON_NAMED_DATA_TRUNCATION |
Win32USN.USNReason.USN_REASON_RENAME_NEW_NAME |
Win32USN.USNReason.USN_REASON_RENAME_OLD_NAME |
Win32USN.USNReason.USN_REASON_REPARSE_POINT_CHANGE |
Win32USN.USNReason.USN_REASON_SECURITY_CHANGE |
Win32USN.USNReason.USN_REASON_STREAM_CHANGE,
ReturnOnlyOnClose = 0,
Timeout = 0,
BytesToWaitFor = 0,
UsnJournalID = m_journal.UsnJournalID
};
var bufferSize = 4096; // larger buffer returns more record, but pervents user from cancelling operation for a longer time
while (readData.StartUsn < m_journal.NextUsn)
{
if (!Win32USN.ControlWithInput(m_volumeHandle, Win32USN.FsCtl.ReadUSNJournal,
ref readData, bufferSize, out var entryData))
{
var e = Marshal.GetLastWin32Error();
if (e == Win32USN.ERROR_HANDLE_EOF || e == Win32USN.ERROR_SUCCESS)
{
break;
}
if (e == Win32USN.ERROR_INSUFFICIENT_BUFFER)
{
bufferSize = bufferSize * 2;
continue;
}
if (e == Win32USN.ERROR_JOURNAL_ENTRY_DELETED)
{
throw new UsnJournalSoftFailureException(Strings.USNHelper.JournalEntriesDeleted, new Win32Exception(e));
}
throw new Win32Exception(e);
}
records.AddRange(EnumerateRecords(entryData).TakeWhile(rec => rec.UsnRecord.Usn >= startUsn && rec.UsnRecord.Usn < m_journal.NextUsn));
readData.StartUsn = Marshal.ReadInt64(entryData, 0);
}
return(records);
}