public void Monitor(List <string> volumes, MFTSearcherCache db) { foreach (var volume in volumes) { Monitor(volume, db); } }
private void ProcessFileCreate(PInvokeWin32.USN_RECORD usn, string volume, MFTSearcherCache db) { USNRecord record = USNRecord.ParseUSN(volume, usn); db.AddRecord(volume, record); Debug.WriteLine(string.Format(">>>> NewFile: {0}", record.FullPath)); if (RecordAddedEvent != null) { RecordAddedEvent(record); } }
internal static void FillPath(string volume, USNRecord record, MFTSearcherCache db) { if (record == null) { return; } var fdSource = db.GetVolumeRecords(volume); string fullpath = record.Name; FindRecordPath(record, ref fullpath, fdSource); record.FullPath = fullpath; }
public void Monitor(string volume, MFTSearcherCache db) { if (string.IsNullOrEmpty(volume)) { throw new InvalidOperationException("Volume cant't be null or empty string."); } if (!db.ContainsVolume(volume)) { throw new InvalidOperationException(string.Format("Volume {0} must be scaned first.")); } ThreadPool.QueueUserWorkItem(o => MonitorThread(volume, db)); }
private void ProcessUSN(PInvokeWin32.USN_RECORD usn, string volume, MFTSearcherCache db) { if (MaskEqual(usn.Reason, USNChangeReason.USN_REASONS["USN_REASON_RENAME_NEW_NAME"])) { ProcessRenameNewName(usn, volume, db); } if ((usn.Reason & USNChangeReason.USN_REASONS["USN_REASON_FILE_CREATE"]) != 0) { ProcessFileCreate(usn, volume, db); } if (MaskEqual(usn.Reason, USNChangeReason.USN_REASONS["USN_REASON_FILE_DELETE"])) { ProcessFileDelete(usn, volume, db); } }
private void ProcessFileDelete(PInvokeWin32.USN_RECORD usn, string volume, MFTSearcherCache db) { var cached = db.FindByFrn(volume, usn.FRN); if (cached != null) { MFTSearcher.FillPath(volume, cached, db); var deleteok = db.DeleteRecord(volume, usn.FRN); Debug.WriteLine(string.Format(">>>> DeleteFIle {0} {1}.", cached.FullPath, deleteok ? "successful" : "fail")); if (RecordDeletedEvent != null) { RecordDeletedEvent(cached); } } }
private void MonitorThread(string volume, MFTSearcherCache db) { IntPtr pbuffer = Marshal.AllocHGlobal(0x1000); PInvokeWin32.READ_USN_JOURNAL_DATA rujd = SetupInputData4JournalRead(volume, 0xFFFFFFFF); UInt32 cbRead; IntPtr prujd; while (true) { prujd = Marshal.AllocHGlobal(Marshal.SizeOf(rujd)); PInvokeWin32.ZeroMemory(prujd, Marshal.SizeOf(rujd)); Marshal.StructureToPtr(rujd, prujd, true); IntPtr pVolume = MFTSearcher.GetVolumeJournalHandle(volume); bool fok = PInvokeWin32.DeviceIoControl(pVolume, PInvokeWin32.FSCTL_READ_USN_JOURNAL, prujd, Marshal.SizeOf(typeof(PInvokeWin32.READ_USN_JOURNAL_DATA)), pbuffer, 0x1000, out cbRead, IntPtr.Zero); IntPtr pRealData = new IntPtr(pbuffer.ToInt32() + Marshal.SizeOf(typeof(Int64))); uint offset = 0; if (fok) { while (offset + Marshal.SizeOf(typeof(Int64)) < cbRead) { PInvokeWin32.USN_RECORD usn = new PInvokeWin32.USN_RECORD(new IntPtr(pRealData.ToInt32() + (int)offset)); ProcessUSN(usn, volume, db); offset += usn.RecordLength; } } Marshal.FreeHGlobal(prujd); rujd.StartUsn = Marshal.ReadInt64(pbuffer); } }
private void ProcessRenameNewName(PInvokeWin32.USN_RECORD usn, string volume, MFTSearcherCache db) { USNRecord newRecord = USNRecord.ParseUSN(volume, usn); db.UpdateRecord(volume, newRecord); var oldRecord = db.FindByFrn(volume, usn.FRN); if (oldRecord != null) { Debug.WriteLine(string.Format(">>>> RenameFile {0} to {1}", oldRecord.FullPath, newRecord.FullPath)); if (RecordRenameEvent != null) { RecordRenameEvent(oldRecord, newRecord); } } }