USN_TRACK_MODIFIED_RANGES - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers 
// ntifs.h

typedef struct {
  ULONG     Flags;
  ULONG     Unused;
  ULONGLONG ChunkSize;
  LONGLONG  FileSizeThreshold;
} USN_TRACK_MODIFIED_RANGES, *PUSN_TRACK_MODIFIED_RANGES;
View the official Windows Driver Kit DDI reference
// winioctl.h

typedef struct {
  DWORD     Flags;
  DWORD     Unused;
  DWORDLONG ChunkSize;
  LONGLONG  FileSizeThreshold;
} USN_TRACK_MODIFIED_RANGES, *PUSN_TRACK_MODIFIED_RANGES;
View the official Win32 API reference

NtDoc

No description available.

Edit description on GitHub

Windows Driver Kit DDI reference (ns-ntifs-usn_track_modified_ranges)

Description

The USN_TRACK_MODIFIED_RANGES structure contains returned update sequence number (USN) from FSCTL_USN_TRACK_MODIFIED_RANGES control code.

Members

Flags

Indicates enabling range tracking.

Value Description
FLAG_USN_TRACK_MODIFIED_RANGES_ENABLE 0x00000001 This flag is mandatory with FSCTL_USN_TR**ACK_MODIFIED_RANGES and is used to enable range tracking on the volume.

Unused

Reserved.

ChunkSize

Chunk size for tracking ranges. A single byte modification will be reflected as the whole chunk being modified.

FileSizeThreshold

File size threshold to start outputting USN_RECORD_V4 structure record(s) for modified file, i.e. if the modified file size is less than this threshold, then no USN_RECORD_V4 record will be output.

See also

FSCTL_USN_TRACK_MODIFIED_RANGES

View the official Windows Driver Kit DDI reference

Edit description on GitHub

Win32 API reference (ns-winioctl-usn_track_modified_ranges)

USN_TRACK_MODIFIED_RANGES structure

Description

Contains information on range tracking parameters for an update sequence number (USN) change journal using the FSCTL_USN_TRACK_MODIFIED_RANGES control code.

Members

Flags

Indicates enabling range tracking.
Value Description
FLAG_USN_TRACK_MODIFIED_RANGES_ENABLE 0x00000001 This flag is mandatory with FSCTL_USN_TRACK_MODIFIED_RANGES and is used to enable range tracking on the volume.

Unused

Reserved.

ChunkSize

Chunk size for tracking ranges. A single byte modification will be reflected as the whole chunk being modified.

FileSizeThreshold

File size threshold to start outputting USN_RECORD_V4 structure record(s) for modified file, i.e. if the modified file size is less than this threshold, then no USN_RECORD_V4 record will be output.

Remarks

Once range tracking is enabled for a given volume it cannot be disabled except by deleting the USN Journal and recreating it.

See also

FSCTL_USN_TRACK_MODIFIED_RANGES

View the official Win32 API reference

Edit description on GitHub