FSCTL_READ_FILE_USN_DATA - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
// ntifs.h
// CTL_CODE(0x0009, 0x03a, METHOD_NEITHER, FILE_ANY_ACCESS)
#define FSCTL_READ_FILE_USN_DATA 0x000900EB
View the official Windows Driver Kit DDI reference// winioctl.h
// CTL_CODE(0x0009, 0x03a, METHOD_NEITHER, FILE_ANY_ACCESS)
#define FSCTL_READ_FILE_USN_DATA 0x000900EB
View the official Win32 API referenceNo description available.
The FSCTL_READ_FILE_USN_DATA control code retrieves the update sequence number (USN) change-journal information for the specified file or directory.
FSCTL_READ_FILE_USN_DATA
To perform this operation, call FltFsControlFile or ZwFsControlFile with the following parameters.
FileObject [in]: Parameter for FltFsControlFile only. A file object pointer for the remote volume. This parameter is required and can't be NULL.
FileHandle [in]: Parameter for ZwFsControlFile only. A handle for the remote volume. This parameter is required and can't be NULL.
FsControlCode [in]: A control code for the operation. Use FSCTL_READ_USN_JOURNAL for this operation.
InputBuffer [in]: Pointer to a READ_FILE_USN_DATA structure.
InputBufferLength [in]: Size in bytes of the buffer at InputBuffer.
OutputBuffer [out]: Pointer to a USN_RECORD structure that receives the USN records.
OutputBufferLength [in]: Size in bytes of the buffer at OutputBuffer.
FltFsControlFile or ZwFsControlFile returns STATUS_SUCCESS if the operation succeeds. Otherwise, the appropriate function returns the appropriate NTSTATUS error code.
Retrieves the update sequence number (USN) change-journal information for the specified file or directory.
To perform this operation, call the DeviceIoControl function with the following parameters.
| C++ |
|---|
BOOL WINAPI DeviceIoControl( (HANDLE) hDevice, // handle to device (DWORD) FSCTL_READ_FILE_USN_DATA, // dwIoControlCode (LPVOID) lpInBuffer, // input buffer (DWORD) nInBufferSize, // size of input buffer (LPVOID) lpOutBuffer, // output buffer (DWORD) nOutBufferSize, // size of output buffer (LPDWORD) lpBytesReturned, // number of bytes returned (LPOVERLAPPED) lpOverlapped ); // OVERLAPPED structure |
Irp->IoStatus.Status is set to STATUS_SUCCESS if the request is successful.
Otherwise, Status to the appropriate error condition as a NTSTATUS code.
For more information, see NTSTATUS Values.
If the call succeeds, the members of the returned USN_RECORD_V2 or USN_RECORD_V3 structure are valid except for the following members: TimeStamp, Reason, and SourceInfo. The Usn member represents the last USN written to the journal for this file or directory.
For more information, see Creating, Modifying, and Deleting a Change Journal.
To retrieve a handle to a volume, call CreateFile with the lpFileName parameter set to a string in the following form:
\.*X*:
In the preceding string, X is the letter identifying the drive on which the volume appears. The volume must be ReFS or NTFS 3.0 or later. To obtain the NTFS version of a volume, open a command prompt with Administrator access rights and execute the following command:
FSUtil.exe FSInfo NTFSInfo X:
where X is the drive letter of the volume.
In Windows 8 and Windows Server 2012, this code is supported by the following technologies.
| Technology | Supported |
|---|---|
| Server Message Block (SMB) 3.0 protocol | No |
| SMB 3.0 Transparent Failover (TFO) | No |
| SMB 3.0 with Scale-out File Shares (SO) | No |
| Cluster Shared Volume File System (CsvFS) | Yes |
Volume Management Control Codes