unsafe internal static bool QueryUSNJournal(IntPtr pVolume, out PInvokeWin32.USN_JOURNAL_DATA ujd, out uint bytesReturned)
{
bool bOK = PInvokeWin32.DeviceIoControl(
pVolume, PInvokeWin32.FSCTL_QUERY_USN_JOURNAL,
IntPtr.Zero,
0,
out ujd,
sizeof(PInvokeWin32.USN_JOURNAL_DATA),
out bytesReturned,
IntPtr.Zero
);
return(bOK);
}
private PInvokeWin32.READ_USN_JOURNAL_DATA SetupInputData4JournalRead(string volume, uint reason)
{
IntPtr pMonitorVolume = MFTSearcher.GetVolumeJournalHandle(volume);
uint bytesReturned = 0;
PInvokeWin32.USN_JOURNAL_DATA ujd = new PInvokeWin32.USN_JOURNAL_DATA();
MFTSearcher.QueryUSNJournal(pMonitorVolume, out ujd, out bytesReturned);
// 构建输入参数
PInvokeWin32.READ_USN_JOURNAL_DATA rujd = new PInvokeWin32.READ_USN_JOURNAL_DATA();
rujd.StartUsn = ujd.NextUsn;
rujd.ReasonMask = reason;
rujd.ReturnOnlyOnClose = 1;
rujd.Timeout = 0;
rujd.BytesToWaitFor = 1;
rujd.UsnJournalID = ujd.UsnJournalID;
return(rujd);
}
unsafe private static void SetupMFTEnumInBuffer(ref IntPtr medBuffer, IntPtr pVolume)
{
uint bytesReturned = 0;
PInvokeWin32.USN_JOURNAL_DATA ujd = new PInvokeWin32.USN_JOURNAL_DATA();
bool bOk = QueryUSNJournal(pVolume, out ujd, out bytesReturned);
if (bOk)
{
PInvokeWin32.MFT_ENUM_DATA med;
med.StartFileReferenceNumber = 0;
med.LowUsn = 0;
med.HighUsn = ujd.NextUsn;
int sizeMftEnumData = Marshal.SizeOf(med);
medBuffer = Marshal.AllocHGlobal(sizeMftEnumData);
PInvokeWin32.ZeroMemory(medBuffer, sizeMftEnumData);
Marshal.StructureToPtr(med, medBuffer, true);
}
else
{
throw new IOException("DeviceIoControl() returned false", new Win32Exception(Marshal.GetLastWin32Error()));
}
}