public static void EnumerateVolume(string volumeName, out List <MyEverythingRecord> files, out List <MyEverythingRecord> flds)
{
files = new List <MyEverythingRecord>();
flds = new List <MyEverythingRecord>();
IntPtr medBuffer = IntPtr.Zero;
IntPtr pVolume = IntPtr.Zero;
try {
AddVolumeRootRecord(volumeName, ref flds); // 获得指定的 volume 对应的 frn, 为将来确定 full path 时提供支持.
pVolume = GetVolumeJournalHandle(volumeName); // 获得通过 CreateFile 函数返回的 handle 值.
EnableVomuleJournal(pVolume); // 打开 Journal, 因为 Journal 默认是关闭的.
SetupMFTEnumInBuffer(ref medBuffer, pVolume); // 为 EnumerateFiles 准备好参数, 即 medBuffer
EnumerateFiles(volumeName, pVolume, medBuffer, ref files, ref flds);
} catch (Exception e) {
Console.WriteLine(e.Message, e);
Exception innerException = e.InnerException;
while (innerException != null)
{
Console.WriteLine(innerException.Message, innerException);
innerException = innerException.InnerException;
}
throw new ApplicationException("Error in EnumerateVolume()", e);
} finally {
if (pVolume.ToInt32() != PInvokeWin32.INVALID_HANDLE_VALUE)
{
PInvokeWin32.CloseHandle(pVolume);
if (medBuffer != IntPtr.Zero)
{
Marshal.FreeHGlobal(medBuffer);
}
}
}
}
private void ProcessFileCreate(PInvokeWin32.USN_RECORD usn, string volume, MyEverythingDB db)
{
MyEverythingRecord record = MyEverythingRecord.ParseUSN(usn);
string fullpath = record.Name;
db.FindRecordPath(record, ref fullpath, db.GetFolderSource(volume));
record.FullPath = fullpath;
db.AddRecord(volume, record, usn.IsFolder ? MyEverythingRecordType.Folder : MyEverythingRecordType.File);
Debug.WriteLine(string.Format(">>>> NewFile: {0}", record.FullPath));
if (RecordAddedEvent != null)
RecordAddedEvent(record);
}
private void ProcessFileDelete(PInvokeWin32.USN_RECORD usn, string volume, MyEverythingDB db)
{
var cached = db.FindByFrn(volume, usn.FRN);
if (cached == null) {
return;
} else {
var isdelete = db.DeleteRecord(volume, usn.FRN);
Debug.WriteLine(string.Format(">>>> File {0} deleted {1}.", cached.FullPath, isdelete ? "successful" : "fail"));
if (RecordDeletedEvent != null)
RecordDeletedEvent(cached);
}
}
unsafe public static bool QueryUSNJournal(IntPtr pVolume, out PInvokeWin32.USN_JOURNAL_DATA ujd, out uint bytesReturned)
{
bool bOK = PInvokeWin32.DeviceIoControl(
pVolume, PInvokeWin32.FSCTL_QUERY_USN_JOURNAL,
IntPtr.Zero,
0,
out ujd,
sizeof(PInvokeWin32.USN_JOURNAL_DATA),
out bytesReturned,
IntPtr.Zero
);
return(bOK);
}
unsafe private static void EnumerateFiles(string volumeName, IntPtr pVolume, IntPtr medBuffer, ref List <MyEverythingRecord> files, ref List <MyEverythingRecord> folders)
{
IntPtr pData = Marshal.AllocHGlobal(sizeof(UInt64) + 0x10000);
PInvokeWin32.ZeroMemory(pData, sizeof(UInt64) + 0x10000);
uint outBytesReturned = 0;
while (false != PInvokeWin32.DeviceIoControl(pVolume, PInvokeWin32.FSCTL_ENUM_USN_DATA, medBuffer,
sizeof(PInvokeWin32.MFT_ENUM_DATA), pData, sizeof(UInt64) + 0x10000, out outBytesReturned,
IntPtr.Zero))
{
IntPtr pUsnRecord = new IntPtr(pData.ToInt32() + sizeof(Int64));
while (outBytesReturned > 60)
{
PInvokeWin32.USN_RECORD usn = new PInvokeWin32.USN_RECORD(pUsnRecord);
if (usn.IsFolder)
{
folders.Add(new MyEverythingRecord {
Name = usn.FileName,
ParentFrn = usn.ParentFRN,
FRN = usn.FRN,
IsFolder = true, VolumeName = volumeName
});
}
else
{
files.Add(new MyEverythingRecord {
Name = usn.FileName,
ParentFrn = usn.ParentFRN,
FRN = usn.FRN,
IsFolder = false, VolumeName = volumeName
});
}
pUsnRecord = new IntPtr(pUsnRecord.ToInt32() + usn.RecordLength);
outBytesReturned -= usn.RecordLength;
}
Marshal.WriteInt64(medBuffer, Marshal.ReadInt64(pData, 0));
}
Marshal.FreeHGlobal(pData);
}
private void MonitorThread(object param)
{
MyEverythingDB db = (param as Dictionary <string, object>)["MyEverythingDB"] as MyEverythingDB;
string volume = (param as Dictionary <string, object>)["Volume"] as string;
IntPtr pbuffer = Marshal.AllocHGlobal(0x1000); // 构建输出参数
PInvokeWin32.READ_USN_JOURNAL_DATA rujd = SetupInputData4JournalRead(volume, 0xFFFFFFFF); // 对所有类型的reason都监听
UInt32 cbRead; // 用来存储实际输出的字节数
IntPtr prujd; // 指向输入参数结构体的指针
while (true)
{
// 构建输入参数的指针
prujd = Marshal.AllocHGlobal(Marshal.SizeOf(rujd));
PInvokeWin32.ZeroMemory(prujd, Marshal.SizeOf(rujd));
Marshal.StructureToPtr(rujd, prujd, true);
Debug.WriteLine(string.Format("\nMoniting on {0}......", volume));
IntPtr pVolume = MyEverything.GetVolumeJournalHandle(volume);
bool fok = PInvokeWin32.DeviceIoControl(pVolume,
PInvokeWin32.FSCTL_READ_USN_JOURNAL,
prujd, Marshal.SizeOf(typeof(PInvokeWin32.READ_USN_JOURNAL_DATA)),
pbuffer, 0x1000, out cbRead, IntPtr.Zero);
IntPtr pRealData = new IntPtr(pbuffer.ToInt32() + Marshal.SizeOf(typeof(Int64))); // 返回的内存块头上的8个字节是一个usn_id, 从第9个字节开始才是record.
uint offset = 0;
if (fok)
{
while (offset + Marshal.SizeOf(typeof(Int64)) < cbRead) // record可能有多个!
{
PInvokeWin32.USN_RECORD usn = new PInvokeWin32.USN_RECORD(new IntPtr(pRealData.ToInt32() + (int)offset));
ProcessUSN(usn, volume, db);
offset += usn.RecordLength;
}
}
Marshal.FreeHGlobal(prujd);
rujd.StartUsn = Marshal.ReadInt64(pbuffer); // 返回的内存块头上的8个字节就是用来在进行下一次查询的
}
}
public static IntPtr GetVolumeJournalHandle(string volumeName)
{
string vol = string.Concat("\\\\.\\", volumeName);
IntPtr pVolume = PInvokeWin32.CreateFile(vol,
PInvokeWin32.GENERIC_READ | PInvokeWin32.GENERIC_WRITE,
PInvokeWin32.FILE_SHARE_READ | PInvokeWin32.FILE_SHARE_WRITE,
IntPtr.Zero,
PInvokeWin32.OPEN_EXISTING,
0,
IntPtr.Zero);
if (pVolume.ToInt32() == PInvokeWin32.INVALID_HANDLE_VALUE)
{
throw new IOException(string.Format("CreateFile(\"{0}\") returned invalid handle", volumeName),
new Win32Exception(Marshal.GetLastWin32Error()));
}
else
{
return(pVolume);
}
}
private static void AddVolumeRootRecord(string volumeName, ref List <MyEverythingRecord> folders)
{
string rightVolumeName = string.Concat("\\\\.\\", volumeName);
rightVolumeName = string.Concat(rightVolumeName, Path.DirectorySeparatorChar);
IntPtr hRoot = PInvokeWin32.CreateFile(rightVolumeName,
0,
PInvokeWin32.FILE_SHARE_READ | PInvokeWin32.FILE_SHARE_WRITE,
IntPtr.Zero,
PInvokeWin32.OPEN_EXISTING,
PInvokeWin32.FILE_FLAG_BACKUP_SEMANTICS,
IntPtr.Zero);
if (hRoot.ToInt32() != PInvokeWin32.INVALID_HANDLE_VALUE)
{
PInvokeWin32.BY_HANDLE_FILE_INFORMATION fi = new PInvokeWin32.BY_HANDLE_FILE_INFORMATION();
bool bRtn = PInvokeWin32.GetFileInformationByHandle(hRoot, out fi);
if (bRtn)
{
UInt64 fileIndexHigh = (UInt64)fi.FileIndexHigh;
UInt64 indexRoot = (fileIndexHigh << 32) | fi.FileIndexLow;
folders.Add(new MyEverythingRecord {
FRN = indexRoot, Name = volumeName, ParentFrn = 0,
IsVolumeRoot = true, IsFolder = true, VolumeName = volumeName
});
}
else
{
throw new IOException("GetFileInformationbyHandle() returned invalid handle",
new Win32Exception(Marshal.GetLastWin32Error()));
}
PInvokeWin32.CloseHandle(hRoot);
}
else
{
throw new IOException("Unable to get root frn entry", new Win32Exception(Marshal.GetLastWin32Error()));
}
}
unsafe private static void SetupMFTEnumInBuffer(ref IntPtr medBuffer, IntPtr pVolume)
{
uint bytesReturned = 0;
PInvokeWin32.USN_JOURNAL_DATA ujd = new PInvokeWin32.USN_JOURNAL_DATA();
bool bOk = QueryUSNJournal(pVolume, out ujd, out bytesReturned);
if (bOk)
{
PInvokeWin32.MFT_ENUM_DATA med;
med.StartFileReferenceNumber = 0;
med.LowUsn = 0;
med.HighUsn = ujd.NextUsn;
int sizeMftEnumData = Marshal.SizeOf(med);
medBuffer = Marshal.AllocHGlobal(sizeMftEnumData);
PInvokeWin32.ZeroMemory(medBuffer, sizeMftEnumData);
Marshal.StructureToPtr(med, medBuffer, true);
}
else
{
throw new IOException("DeviceIoControl() returned false", new Win32Exception(Marshal.GetLastWin32Error()));
}
}
unsafe public static void EnableVomuleJournal(IntPtr pVolume)
{
UInt64 MaximumSize = 0x800000;
UInt64 AllocationDelta = 0x100000;
UInt32 cb;
PInvokeWin32.CREATE_USN_JOURNAL_DATA cujd;
cujd.MaximumSize = MaximumSize;
cujd.AllocationDelta = AllocationDelta;
int sizeCujd = Marshal.SizeOf(cujd);
IntPtr cujdBuffer = Marshal.AllocHGlobal(sizeCujd);
PInvokeWin32.ZeroMemory(cujdBuffer, sizeCujd);
Marshal.StructureToPtr(cujd, cujdBuffer, true);
bool fOk = PInvokeWin32.DeviceIoControl(pVolume, PInvokeWin32.FSCTL_CREATE_USN_JOURNAL,
cujdBuffer, sizeCujd, IntPtr.Zero, 0, out cb, IntPtr.Zero);
if (!fOk)
{
throw new IOException("DeviceIoControl() returned false", new Win32Exception(Marshal.GetLastWin32Error()));
}
}
public static unsafe bool QueryUSNJournal(IntPtr pVolume, out PInvokeWin32.USN_JOURNAL_DATA ujd, out uint bytesReturned)
{
bool bOK = PInvokeWin32.DeviceIoControl(
pVolume, PInvokeWin32.FSCTL_QUERY_USN_JOURNAL,
IntPtr.Zero,
0,
out ujd,
sizeof(PInvokeWin32.USN_JOURNAL_DATA),
out bytesReturned,
IntPtr.Zero
);
return bOK;
}
public static MyEverythingRecord ParseUSN(string volume, PInvokeWin32.USN_RECORD usn)
{
return new MyEverythingRecord { FRN = usn.FRN, Name = usn.FileName,
ParentFrn = usn.ParentFRN, IsFolder = usn.IsFolder, VolumeName = volume };
}
public static MyEverythingRecord ParseUSN(PInvokeWin32.USN_RECORD usn)
{
return new MyEverythingRecord { FRN = usn.FRN, Name = usn.FileName, ParentFrn = usn.ParentFRN };
}
private void ProcessRenameNewName(PInvokeWin32.USN_RECORD usn, string volume, MyEverythingDB db)
{
// frn 没有改变
// newname = usn.FileName
// 根据usn.FRN可以从db中获取oldname
// db.update...
MyEverythingRecord newRecord = MyEverythingRecord.ParseUSN(usn);
string fullpath = newRecord.Name;
db.FindRecordPath(newRecord, ref fullpath, db.GetFolderSource(volume));
newRecord.FullPath = fullpath;
var oldRecord = db.FindByFrn(volume, usn.FRN);
string newname = newRecord.FullPath;
Debug.WriteLine(string.Format(">>>> RenameFile {0} to {1}", oldRecord.FullPath, newname));
db.UpdateRecord(volume, newRecord,
usn.IsFolder ? MyEverythingRecordType.Folder : MyEverythingRecordType.File);
if (RecordRenameEvent != null) RecordRenameEvent(oldRecord, newRecord);
if (newname.Contains("$RECYCLE.BIN")) {
Debug.WriteLine(string.Format(">>>> Means {0} moved to recycle.", oldRecord.FullPath));
}
}
private void ProcessUSN(PInvokeWin32.USN_RECORD usn, string volume, MyEverythingDB db)
{
var dbCached = db.FindByFrn(volume, usn.FRN);
Debug.WriteLine(string.Format("------USN[frn={0}]------", usn.FRN));
Debug.WriteLine(string.Format("FileName={0}, Reason={1}", usn.FileName, Reason.ReasonPrettyFormat(usn.Reason)));
Debug.WriteLine(string.Format("FileName[Cached]={0}", dbCached == null ? "NoCache": dbCached.FullPath));
Debug.WriteLine("--------------------------------------");
if (Util.MaskEqual(usn.Reason, Reason.USN_REASONS["USN_REASON_RENAME_NEW_NAME"]))
ProcessRenameNewName(usn, volume, db);
if ((usn.Reason & Reason.USN_REASONS["USN_REASON_FILE_CREATE"]) != 0)
ProcessFileCreate(usn, volume, db);
if (Util.MaskEqual(usn.Reason, Reason.USN_REASONS["USN_REASON_FILE_DELETE"]))
ProcessFileDelete(usn, volume, db);
}
