public static FileRecordReason Convert(UsnJournalReasonMask mask) { switch (mask) { case UsnJournalReasonMask.USN_REASON_FILE_CREATE: return(FileRecordReason.Create); case UsnJournalReasonMask.USN_REASON_FILE_DELETE: return(FileRecordReason.Delete); default: return(FileRecordReason.Update); } }
/// <summary><see cref="https://msdn.microsoft.com/en-us/library/windows/desktop/aa364586(v=vs.85).aspx"/></summary> public IUSN_RECORD[] FileSystemReadUsnJournal(long volumeJournalId, UsnJournalReasonMask reasonMask, USN firstUsn, int bytesToWaitFor = 0, int timeout = 0) { READ_USN_JOURNAL_DATA_V0 input = new READ_USN_JOURNAL_DATA_V0(); input.StartUsn = firstUsn; input.UsnJournalId = volumeJournalId; input.ReasonMask = reasonMask; input.BytesToWaitFor = bytesToWaitFor; input.Timeout = timeout; int errorCode; byte[] data = DeviceIoControlHelper.InvokeIoControl(Handle, IOControlCode.FsctlReadUsnJournal, 1024 * 1024, input, out errorCode); List <IUSN_RECORD> res = new List <IUSN_RECORD>(); using (UnmanagedMemory mem = new UnmanagedMemory(data)) { int dataOffset = 8; while (dataOffset < data.Length) { int length; IUSN_RECORD rec = ParseUsnRecord(mem, dataOffset, out length); if (length <= 0) { break; } res.Add(rec); // Move to next record dataOffset += length; } } return(res.ToArray()); }
/// <summary><see cref="https://msdn.microsoft.com/en-us/library/windows/desktop/aa364586(v=vs.85).aspx"/></summary> public IUSN_RECORD[] FileSystemReadUsnJournal(long volumeJournalId, UsnJournalReasonMask reasonMask, int bytesToWaitFor = 0, int timeout = 0) { return FileSystemReadUsnJournal(volumeJournalId, reasonMask, new USN(), bytesToWaitFor, timeout); }
//FsctlCreateUsnJournal //FsctlDeleteUsnJournal //FsctlReadFileUsnData //FsctlWriteUsnCloseRecord /// <summary><see cref="https://msdn.microsoft.com/en-us/library/windows/desktop/aa364586(v=vs.85).aspx"/></summary> public IUSN_RECORD[] FileSystemReadUsnJournal(UsnJournalReasonMask reasonMask, int bytesToWaitFor = 0, int timeout = 0) { USN_JOURNAL_DATA_V0 usnQuery = FileSystemQueryUsnJournal(); return FileSystemReadUsnJournal(usnQuery.UsnJournalID, reasonMask, bytesToWaitFor, timeout); }
/// <summary><see cref="https://msdn.microsoft.com/en-us/library/windows/desktop/aa364586(v=vs.85).aspx"/></summary> public IUSN_RECORD[] FileSystemReadUsnJournal(long volumeJournalId, UsnJournalReasonMask reasonMask, USN firstUsn, int bytesToWaitFor = 0, int timeout = 0) { READ_USN_JOURNAL_DATA_V0 input = new READ_USN_JOURNAL_DATA_V0(); input.StartUsn = firstUsn; input.UsnJournalId = volumeJournalId; input.ReasonMask = reasonMask; input.BytesToWaitFor = bytesToWaitFor; input.Timeout = timeout; int errorCode; byte[] data = DeviceIoControlHelper.InvokeIoControl(Handle, IOControlCode.FsctlReadUsnJournal, 1024 * 1024, input, out errorCode); List<IUSN_RECORD> res = new List<IUSN_RECORD>(); using (UnmanagedMemory mem = new UnmanagedMemory(data)) { int dataOffset = 8; while (dataOffset < data.Length) { int length; IUSN_RECORD rec = ParseUsnRecord(mem, dataOffset, out length); if (length <= 0) break; res.Add(rec); // Move to next record dataOffset += length; } } return res.ToArray(); }
/// <summary><see cref="https://msdn.microsoft.com/en-us/library/windows/desktop/aa364586(v=vs.85).aspx"/></summary> public IUSN_RECORD[] FileSystemReadUsnJournal(UsnJournalReasonMask reasonMask, USN firstUsn, int bytesToWaitFor = 0, int timeout = 0) { USN_JOURNAL_DATA_V0 usnQuery = FileSystemQueryUsnJournal(); return(FileSystemReadUsnJournal(usnQuery.UsnJournalID, reasonMask, firstUsn, bytesToWaitFor, timeout)); }
/// <summary><see cref="https://msdn.microsoft.com/en-us/library/windows/desktop/aa364586(v=vs.85).aspx"/></summary> public IUSN_RECORD[] FileSystemReadUsnJournal(long volumeJournalId, UsnJournalReasonMask reasonMask, int bytesToWaitFor = 0, int timeout = 0) { return(FileSystemReadUsnJournal(volumeJournalId, reasonMask, new USN(), bytesToWaitFor, timeout)); }