ChangeJournal v.1.0

Advertisement
Advertisement

The ChangeJournal application was developed to be a small tool that will allow you to operate NTFS's Change Journal.The Change Journal is a database that contains a list of every change made to the files or directories on an NTFS 5.0 volume, that is, the Change Journal is a log file.The structure of Change Journal's record includes USN, Reason, Filename, ParentFileReferenceNumber and TimeStamp, etc.Let me explain them to you:- USN is ID- Reason is why the record is written, say, 'create'- Filename is merely name without path- ParentFileReferenceNumber is a foreign key to file's path- TimeStamp is the time when event happensWith this information, we can know what happened to a file, the only problem is where to find the path of the file. There is no simple/easy way to get there as far as I know. Let's face it, NTFS is not a RDBMS, we can't use one 'select' sentence from relevant tables to get all we need.Although, in concept, ParentFileReferenceNumber is a foreign key. Well, what Window2000 provides us to get a FileReferenceNumber is using an opened handle to the file, the API is GetFileInformationByHandle. We have to search the whole directory tree to find what we want! -- That's why I feel tired for hard drive every time I push the 'Path detail' button.The other thing we should know is that the Change Journal is not available automatically. Somebody should activate/create it before using it.To archive functions on Change Journal, the key API is DeviceIoControl. To fulfill a retrieval of the Change Journal records, the basic steps are:- Open the Change Journal file handle using API CreateFile- Call DeviceIoControl using FSCTL_QUERY_USN_JOURNAL as the second parameter- Call DeviceIoControl using FSCTL_READ_USN_JOURNAL as the second parameter

The ChangeJournal application was developed to ... Allows you to operate NTFS's Change Journal ...

change, journal, handle, reason, record, foreign, directory, path, drive

 
  • ChangeJournal
  • 1.0
  • Jason Q Zhang
  • Win All
  • Shareware
  • 102 Kb
  • 145
 
 

Review ChangeJournal

  • captcha
 
 
New File Management software
  • Express Zip Free for Mac  v.9.19Express Zip Free for Mac is an archiving and compression tool. Express Zip easily creates, manages, and extracts zipped files and folders. This product allows for fast and efficient file zipping and unzipping.
  • ToolsGround MBOX to PST Converter  v.1.0ToolsGround has introduced MBOX to PST app which is an easy-to-use application. The utility exports MBOX to PST MBOX to EML, MBOX to EMLX and MBOX to MSG at top speed. It converts entire data of MBOX including all email components.
  • Express Zip Plus for Mac  v.9.19Express Zip Mac Software for File Compression and Archiving. Easily create, edit, manage and extract compressed files and folders. Compress to reduce file size for email transmission or save hard drive disc space. Supports .rar, .zip, .tar.gz.
  • Hard Disk Data Recovery  v.18.0Hard Disk Data Recovery Tool is the best utility to recover data from external hard drives, USB drives, SD Card, DVD, CD, etc., and many more storage devices. Also, It comes with an interactive GUI for an easy recovery process.
  • Data Recovery Linux Software  v.2.1Linux data recovery software helps to recover & restore Linux data from corrupted, formatted Ext2 & Ext3 partitions.
  • Windows 7 NTFS Recovery  v.3.0Windows 7 NTFS data recovery tool to restore Windows 7 data from Windows 7 drive ...