Change Journal File ID versus FILE_OPEN_BY_FILE_ID

NTFSD
1

I’m reading about the Change Journal feature of NTFS.

MSDN doc says that the ID numbers are private to the journal. Since MSDN
does not document open-by-ID, it could be telling the truth but not the
whole truth. Anyone know the story?

The eventual thing I’m trying to sort out is how to get from a parent
file ID number in a USN_RECORD to the full pathname, especially if the
journal id has changed and the old records for the parent directories
might have gone away.

2

As far as I know those ID numbers are not private to the journal, you can
use use it to open the file by file id. You need to use NtCreateFile to open
a file this way. Then you can query the path of the file using
NtQueryInformationFile specifing FileNameInformation as the information
class.

Alexei.

“Benson Margulies” wrote in message
news:xxxxx@ntfsd…

I’m reading about the Change Journal feature of NTFS.

MSDN doc says that the ID numbers are private to the journal. Since MSDN
does not document open-by-ID, it could be telling the truth but not the
whole truth. Anyone know the story?

The eventual thing I’m trying to sort out is how to get from a parent
file ID number in a USN_RECORD to the full pathname, especially if the
journal id has changed and the old records for the parent directories
might have gone away.

3

There is an example on how to do this in a past MSDN magazine article
complete with sample code: “Keeping an Eye on Your NTFS Drives: the Windows
2000 Change Journal Explained” by Cooperstein and Richter, September/October
1999 issues.

Should be able to download code from MSDN.

/ted

-----Original Message-----
From: Benson Margulies [mailto:xxxxx@basistech.com]
Sent: Wednesday, September 17, 2003 8:25 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Change Journal File ID versus FILE_OPEN_BY_FILE_ID

I’m reading about the Change Journal feature of NTFS.

MSDN doc says that the ID numbers are private to the journal. Since MSDN
does not document open-by-ID, it could be telling the truth but not the
whole truth. Anyone know the story?

The eventual thing I’m trying to sort out is how to get from a parent file
ID number in a USN_RECORD to the full pathname, especially if the journal id
has changed and the old records for the parent directories might have gone
away.

You are currently subscribed to ntfsd as: xxxxx@livevault.com To unsubscribe
send a blank email to xxxxx@lists.osr.com