unsafe internal static bool QueryUSNJournal(IntPtr pVolume, out PInvokeWin32.USN_JOURNAL_DATA ujd, out uint bytesReturned) { bool bOK = PInvokeWin32.DeviceIoControl( pVolume, PInvokeWin32.FSCTL_QUERY_USN_JOURNAL, IntPtr.Zero, 0, out ujd, sizeof(PInvokeWin32.USN_JOURNAL_DATA), out bytesReturned, IntPtr.Zero ); return(bOK); }
private PInvokeWin32.READ_USN_JOURNAL_DATA SetupInputData4JournalRead(string volume, uint reason) { IntPtr pMonitorVolume = MFTSearcher.GetVolumeJournalHandle(volume); uint bytesReturned = 0; PInvokeWin32.USN_JOURNAL_DATA ujd = new PInvokeWin32.USN_JOURNAL_DATA(); MFTSearcher.QueryUSNJournal(pMonitorVolume, out ujd, out bytesReturned); // 构建输入参数 PInvokeWin32.READ_USN_JOURNAL_DATA rujd = new PInvokeWin32.READ_USN_JOURNAL_DATA(); rujd.StartUsn = ujd.NextUsn; rujd.ReasonMask = reason; rujd.ReturnOnlyOnClose = 1; rujd.Timeout = 0; rujd.BytesToWaitFor = 1; rujd.UsnJournalID = ujd.UsnJournalID; return(rujd); }
unsafe private static void SetupMFTEnumInBuffer(ref IntPtr medBuffer, IntPtr pVolume) { uint bytesReturned = 0; PInvokeWin32.USN_JOURNAL_DATA ujd = new PInvokeWin32.USN_JOURNAL_DATA(); bool bOk = QueryUSNJournal(pVolume, out ujd, out bytesReturned); if (bOk) { PInvokeWin32.MFT_ENUM_DATA med; med.StartFileReferenceNumber = 0; med.LowUsn = 0; med.HighUsn = ujd.NextUsn; int sizeMftEnumData = Marshal.SizeOf(med); medBuffer = Marshal.AllocHGlobal(sizeMftEnumData); PInvokeWin32.ZeroMemory(medBuffer, sizeMftEnumData); Marshal.StructureToPtr(med, medBuffer, true); } else { throw new IOException("DeviceIoControl() returned false", new Win32Exception(Marshal.GetLastWin32Error())); } }