FSCTL_ENUM_USN_DATA - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
// ntifs.h
// CTL_CODE(0x0009, 0x02c, METHOD_NEITHER, FILE_ANY_ACCESS)
#define FSCTL_ENUM_USN_DATA 0x000900B3
View the official Windows Driver Kit DDI reference// winioctl.h
// CTL_CODE(0x0009, 0x02c, METHOD_NEITHER, FILE_ANY_ACCESS)
#define FSCTL_ENUM_USN_DATA 0x000900B3
View the official Win32 API referenceNo description available.
The FSCTL_ENUM_USN_DATA control code enumerates the update sequence number (USN) data between two specified boundaries to get master file table (MFT) records.
FSCTL_ENUM_USN_DATA
To perform this operation, call FltFsControlFile or ZwFsControlFile.
See FSCTL_ENUM_USN_DATA IOCTL (winioctl.h) for more information.
Enumerates the update sequence number (USN) data between two specified boundaries to obtain master file table (MFT) records.
To perform this operation, call the DeviceIoControl function with the following parameters.
| C++ |
|---|
BOOL WINAPI DeviceIoControl( (HANDLE) hDevice, // handle to volume (DWORD) FSCTL_ENUM_USN_DATA, // dwIoControlCode(LPVOID) lpInBuffer, // input buffer (DWORD) nInBufferSize, // size of input buffer (LPVOID) lpOutBuffer, // output buffer (DWORD) nOutBufferSize, // size of output buffer (LPDWORD) lpBytesReturned, // number of bytes returned (LPOVERLAPPED) lpOverlapped ); // OVERLAPPED structure); |
Irp->IoStatus.Status is set to STATUS_SUCCESS if the request is successful.
Otherwise, Status to the appropriate error condition as a NTSTATUS code.
For more information, see NTSTATUS Values.
For the implications of overlapped I/O on this operation, see the Remarks section of the DeviceIoControl topic.
To enumerate files on a volume, use the
FSCTL_ENUM_USN_DATA operation one or more times. On the
first call, set the starting point, the StartFileReferenceNumber member of the
MFT_ENUM_DATA structure, to
(DWORDLONG)0. Each call to
FSCTL_ENUM_USN_DATA retrieves the starting point for
the subsequent call as the first entry in the output buffer.
By comparing To identify recent changes to a volume, use the FSCTL_READ_USN_JOURNAL control code.
To retrieve a handle to a volume, call CreateFile with the lpFileName parameter set to a string in the following form:
\\.*X*:
In the preceding string, X is the letter identifying the drive on which the volume appears. The volume must be NTFS.
In Windows 8 and Windows Server 2012, this code is supported by the following technologies.
| Technology | Supported |
|---|---|
| Server Message Block (SMB) 3.0 protocol | No |
| SMB 3.0 Transparent Failover (TFO) | No |
| SMB 3.0 with Scale-out File Shares (SO) | No |
| Cluster Shared Volume File System (CsvFS) | Yes |
Volume Management Control Codes