$usnjrnl query

NTFSD
1

Hi,

Is it possible to access $usnjrnl file and interprete its contents? well i tried with Creatfile but it gave error 5.

So if anybody could answer it that will be gr8.

2

nobody interested?

3

using DeviceIoControl send Irp to the volume’s device, you can enable,
disable USN Journal and read the records.

For more information, you could search on microsoft’s website.

The control code you could find in the headr files of DDK.

xxxxx@yahoo.com wrote:

nobody interested?

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@gmail.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

I replied to you directly on the 3rd because I couldn’t post to the list
at the time. To repeat:

“If I understand your question correctly, look at
FSCTL_QUERY_USN_JOURNAL and the other related IOCTL codes in MSDN. They
can be used from user or kernel mode and will help you get information
from the USN journal.”

xxxxx@yahoo.com wrote:

nobody interested?

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@vipmail.com
To unsubscribe send a blank email to xxxxx@lists.osr.com