示例#1
0
        private static bool ReadJournal(
            SafeFileHandle hVol,
            ref Unmanaged.READ_USN_JOURNAL_DATA readData
            )
        {
            const int JournalBufferSize = 65536;

            var unmanagedReadData = Marshal.AllocHGlobal(Marshal.SizeOf <Unmanaged.READ_USN_JOURNAL_DATA>());

            Marshal.StructureToPtr(readData, unmanagedReadData, false);
            var journalBuffer = Marshal.AllocHGlobal(JournalBufferSize);

            try
            {
                uint dwBytes;
                if (!Unmanaged.DeviceIoControl(
                        hVol,
                        Unmanaged.EIOControlCode.FsctlReadUsnJournal,
                        unmanagedReadData,
                        (uint)Marshal.SizeOf <Unmanaged.READ_USN_JOURNAL_DATA>(),
                        journalBuffer,
                        (uint)JournalBufferSize,
                        out dwBytes,
                        IntPtr.Zero
                        )
                    )
                {
                    Console.WriteLine("Read journal failed {0}", Marshal.GetLastWin32Error());

                    return(false);
                }

                var dwRetBytes = dwBytes - sizeof(Int64);

                // Find the first record
                var record = journalBuffer + sizeof(Int64);

                while (dwRetBytes > 0)
                {
                    //if (   interested.compare(record->FileName) == 0)
                    //{

                    //}
                }

                return
                    (true);
            }
            finally
            {
                Marshal.FreeHGlobal(journalBuffer);
                Marshal.FreeHGlobal(unmanagedReadData);
            }
        }
示例#2
0
        private static bool QueryJournal(
            SafeFileHandle hVol,
            out Unmanaged.USN_JOURNAL_DATA_V0 journalData
            )
        {
            var unmanagedJournalData = Marshal.AllocHGlobal(Marshal.SizeOf <Unmanaged.USN_JOURNAL_DATA_V0>());

            try
            {
                uint dwBytes;
                if (!Unmanaged.DeviceIoControl(
                        hVol,
                        Unmanaged.EIOControlCode.FsctlQueryUsnJournal,
                        IntPtr.Zero,
                        0u,
                        unmanagedJournalData,
                        (uint)Marshal.SizeOf <Unmanaged.USN_JOURNAL_DATA_V0>(), //Unmanaged.USN_JOURNAL_DATA_V0.SizeOf,
                        out dwBytes,
                        IntPtr.Zero
                        )
                    )
                {
                    Console.WriteLine("Query journal failed {0}", Marshal.GetLastWin32Error());

                    journalData = new Unmanaged.USN_JOURNAL_DATA_V0();
                    return(false);
                }

                journalData = Marshal.PtrToStructure <Unmanaged.USN_JOURNAL_DATA_V0>(unmanagedJournalData);

                return
                    (true);
            }
            finally
            {
                Marshal.FreeHGlobal(unmanagedJournalData);
            }
        }