private static void AddVolumeRootRecord(string volumeName, Dictionary <ulong, USNRecord> files) { string rightVolumeName = string.Concat("\\\\.\\", volumeName); rightVolumeName = string.Concat(rightVolumeName, Path.DirectorySeparatorChar); IntPtr hRoot = PInvokeWin32.CreateFile(rightVolumeName, 0, PInvokeWin32.FILE_SHARE_READ | PInvokeWin32.FILE_SHARE_WRITE, IntPtr.Zero, PInvokeWin32.OPEN_EXISTING, PInvokeWin32.FILE_FLAG_BACKUP_SEMANTICS, IntPtr.Zero); if (hRoot.ToInt32() != PInvokeWin32.INVALID_HANDLE_VALUE) { PInvokeWin32.BY_HANDLE_FILE_INFORMATION fi = new PInvokeWin32.BY_HANDLE_FILE_INFORMATION(); bool bRtn = PInvokeWin32.GetFileInformationByHandle(hRoot, out fi); if (bRtn) { UInt64 fileIndexHigh = (UInt64)fi.FileIndexHigh; UInt64 indexRoot = (fileIndexHigh << 32) | fi.FileIndexLow; files.Add(indexRoot, new USNRecord { FRN = indexRoot, Name = volumeName, ParentFrn = 0, IsVolumeRoot = true, IsFolder = true, VolumeName = volumeName }); } else { throw new IOException("GetFileInformationbyHandle() returned invalid handle", new Win32Exception(Marshal.GetLastWin32Error())); } PInvokeWin32.CloseHandle(hRoot); } else { throw new IOException("Unable to get root frn entry", new Win32Exception(Marshal.GetLastWin32Error())); } }
private static void EnumerateVolume(string volumeName, Dictionary <ulong, USNRecord> files) { IntPtr medBuffer = IntPtr.Zero; IntPtr pVolume = IntPtr.Zero; try { AddVolumeRootRecord(volumeName, files); pVolume = GetVolumeJournalHandle(volumeName); EnableVomuleJournal(pVolume); SetupMFTEnumInBuffer(ref medBuffer, pVolume); EnumerateFiles(volumeName, pVolume, medBuffer, files); } catch (Exception e) { Console.WriteLine(e.Message, e); Exception innerException = e.InnerException; while (innerException != null) { Console.WriteLine(innerException.Message, innerException); innerException = innerException.InnerException; } throw new ApplicationException("Error in EnumerateVolume()", e); } finally { if (pVolume.ToInt32() != PInvokeWin32.INVALID_HANDLE_VALUE) { PInvokeWin32.CloseHandle(pVolume); if (medBuffer != IntPtr.Zero) { Marshal.FreeHGlobal(medBuffer); } } } }