private UsnJrnl(byte[] bytes, string volume, ref int offset) { uint RecordLength = RecordLength = BitConverter.ToUInt32(bytes, (0x00 + offset)); VolumePath = volume; Version = new System.Version(BitConverter.ToUInt16(bytes, (0x04 + offset)), BitConverter.ToUInt16(bytes, (0x06 + offset))); RecordNumber = (BitConverter.ToUInt64(bytes, (0x08 + offset)) & 0x0000FFFFFFFFFFFF); FileSequenceNumber = ParentFileSequenceNumber = BitConverter.ToUInt16(bytes, (0x0E + offset)); ParentFileRecordNumber = (BitConverter.ToUInt64(bytes, (0x10 + offset)) & 0x0000FFFFFFFFFFFF); ParentFileSequenceNumber = BitConverter.ToUInt16(bytes, (0x16 + offset)); Usn = BitConverter.ToUInt64(bytes, (0x18 + offset)); TimeStamp = DateTime.FromFileTimeUtc(BitConverter.ToInt64(bytes, (0x20 + offset))); Reason = ((USN_REASON)BitConverter.ToUInt32(bytes, (0x28 + offset))); SourceInfo = ((USN_SOURCE)BitConverter.ToUInt32(bytes, (0x2C + offset))); SecurityId = BitConverter.ToUInt32(bytes, (0x30 + offset)); FileAttributes = ((StandardInformation.ATTR_STDINFO_PERMISSION)BitConverter.ToUInt32(bytes, (0x34 + offset))); ushort fileNameLength = BitConverter.ToUInt16(bytes, (0x38 + offset)); ushort fileNameOffset = BitConverter.ToUInt16(bytes, (0x3A + offset)); FileName = Encoding.Unicode.GetString(bytes, 0x3C + offset, fileNameLength); offset += (int)RecordLength; }