private MFT_ENUM_DATA_V0 SetupMFTEnumData(SafeHandle volume)
{
MFT_ENUM_DATA_V0 med;
using (var ujdHandle = SafeHGlobalHandle.Alloc(Marshal.SizeOf <USN_JOURNAL_DATA>()))
{
var ujd = new USN_JOURNAL_DATA();
Marshal.StructureToPtr(ujd, ujdHandle, true);
var success = PInvoke.DeviceIoControl(volume.DangerousGetHandle(),
DeviceIoControlCode.FsctlQueryUsnJournal,
IntPtr.Zero,
0,
ujdHandle,
Marshal.SizeOf <USN_JOURNAL_DATA>(),
out uint _,
IntPtr.Zero);
if (success)
{
med.StartFileReferenceNumber = 0;
med.LowUsn = 0;
med.HighUsn = ujd.NextUsn;
}
else
{
throw new Win32Exception(Marshal.GetLastWin32Error());
}
}
return(med);
}
unsafe private void SetupDataBuffer(ref IntPtr medBuffer)
{
uint bytesReturned = 0;
USN_JOURNAL_DATA ujd = new USN_JOURNAL_DATA();
bool bOk = NativeWrapper.DeviceIoControl(_changeJournalRootHandle, // Handle to drive
NativeWrapper.FSCTL_QUERY_USN_JOURNAL, // IO Control Code
IntPtr.Zero, // In Buffer
0, // In Buffer Size
out ujd, // Out Buffer
sizeof(USN_JOURNAL_DATA), // Size Of Out Buffer
out bytesReturned, // Bytes Returned
IntPtr.Zero); // lpOverlapped
if (bOk)
{
MFT_ENUM_DATA med;
med.StartFileReferenceNumber = 0;
med.LowUsn = 0;
med.HighUsn = ujd.NextUsn;
int sizeMftEnumData = Marshal.SizeOf(med);
medBuffer = Marshal.AllocHGlobal(sizeMftEnumData);
NativeWrapper.ZeroMemory(medBuffer, sizeMftEnumData);
Marshal.StructureToPtr(med, medBuffer, true);
}
else
{
throw new IOException("DeviceIoControl() returned false", new Win32Exception(Marshal.GetLastWin32Error()));
}
}
public static extern bool DeviceIoControl(
IntPtr hDevice,
UInt32 dwIoControlCode,
IntPtr lpInBuffer,
Int32 nInBufferSize,
out USN_JOURNAL_DATA lpOutBuffer,
Int32 nOutBufferSize,
out uint lpBytesReturned,
IntPtr lpOverlapped);
/// <summary>
/// Copy constructor, creates an instance of this type,
/// populating elements from the corresponding structure.
/// </summary>
/// <param name="nativeData"></param>
internal JournalData(USN_JOURNAL_DATA nativeData)
{
ID = nativeData.UsnJournalID;
FirstUSN = nativeData.FirstUsn;
NextUSN = nativeData.NextUsn;
LowestValidUSN = nativeData.LowestValidUsn;
MaximumUSN = nativeData.MaxixmumUsn;
MaximumSize = nativeData.MaximumSize;
AllocationDelta = nativeData.AllocationDelta;
}
public UsnJournalData(DriveInfo drive, USN_JOURNAL_DATA ntfsUsnJournalData)
{
this.Drive = drive;
this.UsnJournalID = ntfsUsnJournalData.UsnJournalID;
this.FirstUsn = ntfsUsnJournalData.FirstUsn;
this.NextUsn = ntfsUsnJournalData.NextUsn;
this.LowestValidUsn = ntfsUsnJournalData.LowestValidUsn;
this.MaxUsn = ntfsUsnJournalData.MaxUsn;
this.MaximumSize = ntfsUsnJournalData.MaximumSize;
this.AllocationDelta = ntfsUsnJournalData.AllocationDelta;
}
public UsnOperator(DriveInfo drive)
{
if (string.Compare(drive.DriveFormat, "ntfs", true) != 0)
{
throw new ArgumentException("USN journal only exists in NTFS drive.");
}
this.Drive = drive;
this.DriveRootHandle = this.GetRootHandle();
this.ntfsUsnJournalData = new USN_JOURNAL_DATA();
}
public static extern bool DeviceIoControl(
SafeFileHandle hDevice,
EIOControlCode IoControlCode,
[MarshalAs(UnmanagedType.AsAny)]
[In] object InBuffer,
uint nInBufferSize,
[Out] out USN_JOURNAL_DATA OutBuffer,
uint nOutBufferSize,
ref uint pBytesReturned,
[In] IntPtr overlapped //[In] ref System.Threading.NativeOverlapped Overlapped
);
private JournalData ReadJournalDataImpl()
{
try
{
var journalData = new USN_JOURNAL_DATA();
Win32DeviceControl.ControlWithOutput(ChangeJournalHandle, Win32ControlCode.QueryUsnJournal, ref journalData);
return(new JournalData(journalData));
}
catch (Win32Exception ex) when(ex.NativeErrorCode == (int)Win32ErrorCode.ERROR_JOURNAL_NOT_ACTIVE)
{
return(new JournalData());
}
}
private UsnErrorCode QueryUSNJournal()
{
int sizeUsnJournalData = Marshal.SizeOf(this.ntfsUsnJournalData);
USN_JOURNAL_DATA tempUsnJournalData;
uint bytesReturnedCount;
bool isSuccess = Win32Api.DeviceIoControl(
this.DriveRootHandle,
UsnControlCode.FSCTL_QUERY_USN_JOURNAL,
IntPtr.Zero,
0,
out tempUsnJournalData,
sizeUsnJournalData,
out bytesReturnedCount,
IntPtr.Zero);
this.ntfsUsnJournalData = tempUsnJournalData;
//if (isSuccess)
//{
// return tempUsnJournalData;
//}
//else
//{
//int win32ErrorCode = Marshal.GetLastWin32Error();
//if (Enum.IsDefined(typeof(UsnErrorCode), win32ErrorCode))
//{
// var usnErrorCode = (UsnErrorCode)win32ErrorCode;
//}
// throw new IOException("Drive returned false for Query Usn Journal", new Win32Exception(win32ErrorCode));
//}
return((UsnErrorCode)Marshal.GetLastWin32Error());
}
public static extern bool DeviceIoControl(IntPtr hDevice,
UInt32 dwIoControlCode,
IntPtr lpInBuffer, Int32 nInBufferSize,
out USN_JOURNAL_DATA lpOutBuffer, Int32 nOutBufferSize,
out uint lpBytesReturned, IntPtr lpOverlapped);
