FSCTL_READ_USN_JOURNAL - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
// ntifs.h
// CTL_CODE(0x0009, 0x02e, METHOD_NEITHER, FILE_ANY_ACCESS)
#define FSCTL_READ_USN_JOURNAL 0x000900BB
View the official Windows Driver Kit DDI reference// winioctl.h
// CTL_CODE(0x0009, 0x02e, METHOD_NEITHER, FILE_ANY_ACCESS)
#define FSCTL_READ_USN_JOURNAL 0x000900BB
View the official Win32 API referenceNo description available.
The FSCTL_READ_USN_JOURNAL control code retrieves the set of update sequence number (USN) change journal records between two specified USN values. See Remarks.
FSCTL_READ_USN_JOURNAL
There are two control codes that return USN records, FSCTL_READ_USN_JOURNAL and FSCTL_ENUM_USN_DATA. Use the latter when you want a listing (enumeration) of the USN records between two USNs. Use the former when you want to select by USN.
To perform this operation, call FltFsControlFile or ZwFsControlFile with the following parameters.
FileObject [in]: Parameter for FltFsControlFile only. A file object pointer for the remote volume. This parameter is required and can't be NULL.
FileHandle [in]: Parameter for ZwFsControlFile only. A handle for the remote volume. This parameter is required and can't be NULL.
FsControlCode [in]: A control code for the operation. Use FSCTL_READ_USN_JOURNAL for this operation.
InputBuffer [in]: Pointer to a READ_USN_JOURNAL_DATA structure.
InputBufferLength [in]: Size in bytes of the buffer at InputBuffer.
OutputBuffer [out]: Pointer to a USN_RECORD_V2 structure that receives the USN records.
OutputBufferLength [in]: Size in bytes of the buffer at OutputBuffer.
FltFsControlFile or ZwFsControlFile returns STATUS_SUCCESS if the operation succeeds. Otherwise, the appropriate function returns the appropriate NTSTATUS error code.
Retrieves the set of update sequence number (USN) change journal records between two specified USN values.
| C++ |
|---|
BOOL WINAPI DeviceIoControl( (HANDLE) hDevice, // handle to volume (DWORD) FSCTL_READ_USN_JOURNAL, // dwIoControlCode (LPVOID) lpInBuffer, // input buffer (DWORD) nInBufferSize, // size of input buffer (LPVOID) lpOutBuffer, // output buffer (DWORD) nOutBufferSize, // size of output buffer (LPDWORD) lpBytesReturned, // number of bytes returned (LPOVERLAPPED) lpOverlapped ); // OVERLAPPED structure |
Irp->IoStatus.Status is set to STATUS_SUCCESS if the request is successful.
Otherwise, Status to the appropriate error condition as a NTSTATUS code.
For more information, see NTSTATUS Values.
For the implications of overlapped I/O on this operation, see the Remarks section of the DeviceIoControl topic.
There are two DeviceIoControl control codes that return USN records, FSCTL_READ_USN_JOURNAL and FSCTL_ENUM_USN_DATA. Use the latter when you want a listing (enumeration) of the USN records between two USNs. Use the former when you want to select by USN.
For more information, see Creating, Modifying, and Deleting a Change Journal.
To retrieve a handle to a volume, call CreateFile with the lpFileName parameter set to a string in the following form:
\.*X*:
In the preceding string, X is the letter identifying the drive on which the volume appears. The volume must be NTFS.
In Windows 8 and Windows Server 2012, this code is supported by the following technologies.
| Technology | Supported |
|---|---|
| Server Message Block (SMB) 3.0 protocol | No |
| SMB 3.0 Transparent Failover (TFO) | No |
| SMB 3.0 with Scale-out File Shares (SO) | No |
| Cluster Shared Volume File System (CsvFS) | See comment |
An application may experience false positives on CsvFs pause/resume.
For an example, see Walking a Buffer of Change Journal Records.
Volume Management Control Codes