private unsafe void CreateChangeJournal()
        {
            // This function creates a journal on the volume. If a journal already
            // exists this function will adjust the MaximumSize and AllocationDelta
            // parameters of the journal
            UInt64 MaximumSize     = 0x800000;
            UInt64 AllocationDelta = 0x100000;
            UInt32 cb;

            MFTReader.CREATE_USN_JOURNAL_DATA cujd;
            cujd.MaximumSize     = MaximumSize;
            cujd.AllocationDelta = AllocationDelta;

            int    sizeCujd   = Marshal.SizeOf(cujd);
            IntPtr cujdBuffer = Marshal.AllocHGlobal(sizeCujd);

            MFTReader.ZeroMemory(cujdBuffer, sizeCujd);
            Marshal.StructureToPtr(cujd, cujdBuffer, true);

            bool fOk = MFTReader.DeviceIoControl(_changeJournalRootHandle, MFTReader.FSCTL_CREATE_USN_JOURNAL,
                                                 cujdBuffer, sizeCujd, IntPtr.Zero, 0, out cb, IntPtr.Zero);

            if (!fOk)
            {
                throw new IOException("DeviceIoControl() returned false", new Win32Exception(Marshal.GetLastWin32Error()));
            }
        }
        private unsafe void SetupMFT_Enum_DataBuffer(ref IntPtr medBuffer)
        {
            uint bytesReturned = 0;

            MFTReader.USN_JOURNAL_DATA ujd = new MFTReader.USN_JOURNAL_DATA();

            bool bOk = MFTReader.DeviceIoControl(_changeJournalRootHandle,           // Handle to drive
                                                 MFTReader.FSCTL_QUERY_USN_JOURNAL,  // IO Control Code
                                                 IntPtr.Zero,                        // In Buffer
                                                 0,                                  // In Buffer Size
                                                 out ujd,                            // Out Buffer
                                                 sizeof(MFTReader.USN_JOURNAL_DATA), // Size Of Out Buffer
                                                 out bytesReturned,                  // Bytes Returned
                                                 IntPtr.Zero);                       // lpOverlapped

            if (bOk)
            {
                MFTReader.MFT_ENUM_DATA med;
                med.StartFileReferenceNumber = 0;
                med.LowUsn  = 0;
                med.HighUsn = ujd.NextUsn;
                int sizeMftEnumData = Marshal.SizeOf(med);
                medBuffer = Marshal.AllocHGlobal(sizeMftEnumData);
                MFTReader.ZeroMemory(medBuffer, sizeMftEnumData);
                Marshal.StructureToPtr(med, medBuffer, true);
            }
            else
            {
                throw new IOException("DeviceIoControl() returned false", new Win32Exception(Marshal.GetLastWin32Error()));
            }
        }
        public unsafe void EnumerateFiles(IntPtr medBuffer, ref Dictionary <ulong, FileNameAndParentFrn> files, string[] fileExtensions)
        {
            IntPtr pData = Marshal.AllocHGlobal(sizeof(UInt64) + 0x10000);

            MFTReader.ZeroMemory(pData, sizeof(UInt64) + 0x10000);
            uint outBytesReturned = 0;

            while (false != MFTReader.DeviceIoControl(_changeJournalRootHandle, MFTReader.FSCTL_ENUM_USN_DATA, medBuffer,
                                                      sizeof(MFTReader.MFT_ENUM_DATA), pData, sizeof(UInt64) + 0x10000, out outBytesReturned,
                                                      IntPtr.Zero))
            {
                IntPtr pUsnRecord = new IntPtr(pData.ToInt32() + sizeof(Int64));
                while (outBytesReturned > 60)
                {
                    MFTReader.USN_RECORD usn = new MFTReader.USN_RECORD(pUsnRecord);
                    if (0 != (usn.FileAttributes & MFTReader.FILE_ATTRIBUTE_DIRECTORY))
                    {
                        //
                        // handle directories
                        //
                        if (!_directories.ContainsKey(usn.FileReferenceNumber))
                        {
                            _directories.Add(usn.FileReferenceNumber,
                                             new FileNameAndParentFrn(usn.FileName, usn.ParentFileReferenceNumber));
                        }
                        else       // this is debug code and should be removed when we are certain that
                        // duplicate frn's don't exist on a given drive.  To date, this exception has
                        // never been thrown.  Removing this code improves performance....
                        {
                            throw new Exception(string.Format("Duplicate FRN: {0} for {1}",
                                                              usn.FileReferenceNumber, usn.FileName));
                        }
                    }
                    else
                    {
                        //
                        // handle files
                        //

                        // at this point we could get the * for the extension
                        bool add      = true;
                        bool fullpath = false;
                        if (fileExtensions != null && fileExtensions.Length != 0)
                        {
                            if (fileExtensions[0].ToString() == "*")
                            {
                                add      = true;
                                fullpath = true;
                            }
                            else
                            {
                                add = false;
                                string s = Path.GetExtension(usn.FileName);
                                foreach (string extension in fileExtensions)
                                {
                                    if (0 == string.Compare(s, extension, true))
                                    {
                                        add = true;
                                        break;
                                    }
                                }
                            }
                        }
                        if (add)
                        {
                            if (fullpath)
                            {
                                if (!files.ContainsKey(usn.FileReferenceNumber))
                                {
                                    files.Add(usn.FileReferenceNumber,
                                              new FileNameAndParentFrn(usn.FileName, usn.ParentFileReferenceNumber));
                                }
                                else
                                {
                                    FileNameAndParentFrn frn = files[usn.FileReferenceNumber];
                                    if (0 != string.Compare(usn.FileName, frn.Name, true))
                                    {
                                        //	Log.InfoFormat(
                                        //	"Attempt to add duplicate file reference number: {0} for file {1}, file from index {2}",
                                        //	usn.FileReferenceNumber, usn.FileName, frn.Name);
                                        throw new Exception(string.Format("Duplicate FRN: {0} for {1}",
                                                                          usn.FileReferenceNumber, usn.FileName));
                                    }
                                }
                            }
                            else
                            {
                                if (!files.ContainsKey(usn.FileReferenceNumber))
                                {
                                    files.Add(usn.FileReferenceNumber,
                                              new FileNameAndParentFrn(usn.FileName, usn.ParentFileReferenceNumber));
                                }
                                else
                                {
                                    FileNameAndParentFrn frn = files[usn.FileReferenceNumber];
                                    if (0 != string.Compare(usn.FileName, frn.Name, true))
                                    {
                                        //	Log.InfoFormat(
                                        //	"Attempt to add duplicate file reference number: {0} for file {1}, file from index {2}",
                                        //	usn.FileReferenceNumber, usn.FileName, frn.Name);
                                        throw new Exception(string.Format("Duplicate FRN: {0} for {1}",
                                                                          usn.FileReferenceNumber, usn.FileName));
                                    }
                                }
                            }
                        }
                    }
                    pUsnRecord        = new IntPtr(pUsnRecord.ToInt32() + usn.RecordLength);
                    outBytesReturned -= usn.RecordLength;
                }
                Marshal.WriteInt64(medBuffer, Marshal.ReadInt64(pData, 0));
            }
            Marshal.FreeHGlobal(pData);
        }