<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=unicode" /> <meta http-equiv="Content-Language" content="en-us" /> <style> <!-- p.MsoNormal, li.MsoNormal {margin-top:0mm; margin-right:0mm; margin-bottom:10.0pt; margin-left:0mm; line-height:115%; font-size:11.0pt; font-family:"Calibri","sans-serif";} a:link {color:blue; text-decoration:underline;} a:visited {color:purple; text-decoration:underline;} p {margin-right:0mm; margin-left:0mm; font-size:12.0pt; font-family:"Times New Roman","serif";} ol {margin-bottom:0mm;} --> </style> <title>Walking a Buffer of Change Journal Records Program Example</title> <meta name="keywords" content="journal, storage, hard disk, volume, programming, tutorial, project, develpment" /> <meta name="description" content="C program example on Walking a Buffer of Change Journal Records Program Example using Visual Studio" /> </head> <body lang="EN-US" link="#0000FF" vlink="#800080" topmargin="20" leftmargin="20" rightmargin="20" bottommargin="20"> <div class="Section1"> <h1 align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="5" face="Times New Roman"> <span style="line-height:115%;font-family:&quot;Arial&quot;; font-weight:400"> Win32 Windows Volume Program and Code Example 11</span></font></h1> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt" align="center"> <script type="text/javascript"><!-- google_ad_client = "pub-8089415323104206"; google_ad_slot = "0761177910"; google_ad_width = 728; google_ad_height = 90; //--> </script> &nbsp;<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"> </script></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><b><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;;font-weight:bold">Change Journals</span></font></b></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">An automatic backup application is one example of a program that must check for changes to the state of a volume to perform its task. The brute force method of checking for changes in directories or files is to scan the entire volume. However, this is often not an acceptable approach because of the decrease in system performance it would cause. Another method is for the application to register a directory notification (by calling the FindFirstChangeNotification() or ReadDirectoryChangesW() functions) for the directories to be backed up. This is more efficient than the first method, however, it requires that an application be running at all times. Also, if a large number of directories and files must be backed up, the amount of processing and memory overhead for such an application might also cause the operating system&#39;s performance to decrease.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><b><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;;font-weight:bold">To avoid these disadvantages, the NTFS file system maintains a change journal</span></font></b><font size="3" face="Times New Roman"><span style="font-size:12.0pt;font-family:&quot;Arial&quot;">. When any change is made to a file or directory in a volume, the change journal for that volume is updated with a description of the change and the name of the file or directory. </span> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">Change journals are also needed to recover file system indexing, for example after a computer or volume failure. The ability to recover indexing means the file system can avoid the time-consuming process of reindexing the entire volume in such cases.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><b><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;;font-weight:bold">Change Journal Records</span></font></b></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">As files, directories, and other NTFS file system objects are added, deleted, and modified, the NTFS file system enters change journal records in streams, one for each volume on the computer. Each record indicates the type of change and the object changed. The offset from the beginning of the stream for a particular record is called the <b>update sequence number</b> (<a target="_blank" title="The update sequence number" href="http://msdn.microsoft.com/en-us/library/aa365722(VS.85).aspx">USN</a>) for the particular record. New records are appended to the end of the stream. The NTFS file system may delete old records in order to conserve space. If needed records have been deleted, the indexing service recovers by re-indexing the volume, as it does when no change journal exists.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">The change journal logs only the fact of a change to a file and the reason for the change (for example, write operations, truncation, lengthening, deletion, and so on). It does not record enough information to allow reversing the change. In addition, multiple changes to the same file may result in only one reason flag being added to the current record. If the same kind of change occurs more than once, the NTFS file system does not write a new record for the changes after the first. For example, several write operations with no intervening close and reopen operations result in only one change record with the reason flag USN_REASON_DATA_OVERWRITE set. To illustrate how the change journal works, suppose a user accesses a file in the following order:</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <ol style="margin-top:0mm" start="1" type="1"> <li class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">Writes to the file.</span></font></li> <li class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">Sets the time stamp for the file.</span></font></li> <li class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">Writes to the file.</span></font></li> <li class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">Truncates the file.</span></font></li> <li class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">Writes to the file.</span></font></li> <li class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">Closes the file.</span></font></li> </ol> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">In this case, the NTFS file system takes the following actions in the change journal (where | indicates a bitwise OR operation).</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <div align="center"> <table class="MsoNormalTable" border="1" cellspacing="0" cellpadding="0" style="border-collapse:collapse;border:none"> <tr> <td bgcolor="#E6E6E6" style="border:solid black 1.0pt;background:#E6E6E6; padding:0mm 5.4pt 0mm 5.4pt"> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><b><font size="3" face="Times New Roman"> <span style="font-size:12.0pt;line-height:115%;font-family:&quot;Arial&quot;; font-weight:bold">Event</span></font></b></p> </td> <td bgcolor="#E6E6E6" style="border:solid black 1.0pt;border-left:none; background:#E6E6E6;padding:0mm 5.4pt 0mm 5.4pt" width="1007"> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><b><font size="3" face="Times New Roman"> <span style="font-size:12.0pt;line-height:115%;font-family:&quot;Arial&quot;; font-weight:bold">NTFS file system action</span></font></b></p> </td> </tr> <tr> <td style="border:solid black 1.0pt;border-top:none;padding:0mm 5.4pt 0mm 5.4pt"> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Times New Roman"> <span style="font-size:12.0pt;line-height:115%; font-family:&quot;Arial&quot;">Initial write operation</span></font></p> </td> <td style="border-top:none;border-left:none;border-bottom:solid black 1.0pt; border-right:solid black 1.0pt;padding:0mm 5.4pt 0mm 5.4pt" width="1007"> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Times New Roman"> <span style="font-size:12.0pt;line-height:115%; font-family:&quot;Arial&quot;">The NTFS file system writes a new USN record with the USN_REASON_DATA_OVERWRITE reason flag set.</span></font></p> </td> </tr> <tr> <td style="border:solid black 1.0pt;border-top:none;padding:0mm 5.4pt 0mm 5.4pt"> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Times New Roman"> <span style="font-size:12.0pt;line-height:115%; font-family:&quot;Arial&quot;">Setting of file time stamp</span></font></p> </td> <td style="border-top:none;border-left:none;border-bottom:solid black 1.0pt; border-right:solid black 1.0pt;padding:0mm 5.4pt 0mm 5.4pt" width="1007"> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Times New Roman"> <span style="font-size:12.0pt;line-height:115%; font-family:&quot;Arial&quot;">The NTFS file system writes a new USN record with the flag setting USN_REASON_DATA_OVERWRITE | USN_REASON_BASIC_INFO_CHANGE.</span></font></p> </td> </tr> <tr> <td style="border:solid black 1.0pt;border-top:none;padding:0mm 5.4pt 0mm 5.4pt"> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Times New Roman"> <span style="font-size:12.0pt;line-height:115%; font-family:&quot;Arial&quot;">Second write operation</span></font></p> </td> <td style="border-top:none;border-left:none;border-bottom:solid black 1.0pt; border-right:solid black 1.0pt;padding:0mm 5.4pt 0mm 5.4pt" width="1007"> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Times New Roman"> <span style="font-size:12.0pt;line-height:115%; font-family:&quot;Arial&quot;">The NTFS file system does not write a new USN record. Because USN_REASON_DATA_OVERWRITE is already set for the existing record, no changes are made to the record.</span></font></p> </td> </tr> <tr> <td style="border:solid black 1.0pt;border-top:none;padding:0mm 5.4pt 0mm 5.4pt"> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Times New Roman"> <span style="font-size:12.0pt;line-height:115%; font-family:&quot;Arial&quot;">File truncation</span></font></p> </td> <td style="border-top:none;border-left:none;border-bottom:solid black 1.0pt; border-right:solid black 1.0pt;padding:0mm 5.4pt 0mm 5.4pt" width="1007"> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Times New Roman"> <span style="font-size:12.0pt;line-height:115%; font-family:&quot;Arial&quot;">The NTFS file system writes a new USN record with the flag setting USN_REASON_DATA_OVERWRITE | USN_REASON_BASIC_INFO_CHANGE | USN_REASON_DATA_TRUNCATION.</span></font></p> </td> </tr> <tr> <td style="border:solid black 1.0pt;border-top:none;padding:0mm 5.4pt 0mm 5.4pt"> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Times New Roman"> <span style="font-size:12.0pt;line-height:115%; font-family:&quot;Arial&quot;">Third write operation</span></font></p> </td> <td style="border-top:none;border-left:none;border-bottom:solid black 1.0pt; border-right:solid black 1.0pt;padding:0mm 5.4pt 0mm 5.4pt" width="1007"> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Times New Roman"> <span style="font-size:12.0pt;line-height:115%; font-family:&quot;Arial&quot;">The NTFS file system does not write a new USN record. Because USN_REASON_DATA_OVERWRITE is already set for the existing record, no changes are made to the record.</span></font></p> </td> </tr> <tr> <td style="border:solid black 1.0pt;border-top:none;padding:0mm 5.4pt 0mm 5.4pt"> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Times New Roman"> <span style="font-size:12.0pt;line-height:115%; font-family:&quot;Arial&quot;">Close operation</span></font></p> </td> <td style="border-top:none;border-left:none;border-bottom:solid black 1.0pt; border-right:solid black 1.0pt;padding:0mm 5.4pt 0mm 5.4pt" width="1007"> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Times New Roman"> <span style="font-size:12.0pt;line-height:115%; font-family:&quot;Arial&quot;">If the user making changes is the only user of the file, the NTFS file system writes a new USN record with the following flag setting: USN_REASON_DATA_OVERWRITE | USN_REASON_BASIC_INFO_CHANGE | USN_REASON_DATA_TRUNCATION | USN_REASON_CLOSE.</span></font></p> </td> </tr> </table> </div> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">The change journal accumulates a series of records between the first opening and last closing of a file. Each record has a new reason flag set, indicating that a new kind of change has occurred. The sequence of records gives a partial history of the file. The final record, created when the file is closed, adds the USN_REASON_CLOSE flag. This record represents a summary of changes to the file, but unlike the prior records, gives no indication of the order of the changes. The next user to access and change the file generates a new USN record with a single reason flag.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><b><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;;font-weight:bold">Using the Change Journal Identifier</span></font></b></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">The NTFS file system associates an unsigned 64-bit identifier with each change journal. The journal is stamped with this identifier when it is created. The file system stamps the journal with a new identifier where the existing USN records either are or may be unusable. For example, the NTFS file system re-stamps a change journal with a new identifier when a volume is moved from Windows 2000 to Windows XP and then back to Windows 2000. Such a move can happen in a dual-boot environment or when working with removable media.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">To obtain the identifier of the current change journal on a specified volume, use the FSCTL_QUERY_USN_JOURNAL control code. To perform this and all other change journal operations, you must have system administrator privileges. That is, you must be a member of the Administrators group. When an administrator deletes and recreates the change journal, for example when the current USN value approaches the maximum possible USN value, the USN values begin again from zero. When the NTFS file system stamps a journal with a new identifier rather than recreating the journal, it does not reset the USN to zero but continues from the current USN. In either case, all existing USNs are less than any future USNs. When you need information on a specific set of records, use the FSCTL_QUERY_USN_JOURNAL control code to obtain the change journal identifier. Then use the FSCTL_READ_USN_JOURNAL control code to read the journal records of interest. The NTFS file system only returns records that are valid for the journal specified by the identifier. Your application needs both the records&#39; USNs and the identifier to read the journal. This requirement provides an integrity check for cases where your application should ignore the existing records in the file and where records were written in previous instances of the journal for the same volume. To obtain the records in which you are interested, you must start at the oldest record (that is, with the lowest USN) and scan forward until you locate the first record of interest.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><b><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;;font-weight:bold">Creating, Modifying, and Deleting a Change Journal</span></font></b></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">Administrators can create, delete, and recreate change journals at will. An administrator should delete a journal when the current USN value approaches the maximum possible USN value, as indicated by the MaxUsn member of the USN_JOURNAL_DATA structure. An administrator might also delete and recreate a change journal to reclaim disk space. To perform this and all other non-programmatic change journal operations, you must have system administrator privileges. That is, you must be a member of the Administrators group. To create or modify a change journal on a specified volume programmatically, use the FSCTL_CREATE_USN_JOURNAL control code. When you create a new change journal or modify an existing one, the NTFS file system sets information for that change journal from information in the CREATE_USN_JOURNAL_DATA structure, which FSCTL_CREATE_USN_JOURNAL takes as input. CREATE_USN_JOURNAL_DATA has the members MaximumSize and AllocationDelta. MaximumSize is the target maximum size for the change journal in bytes. The change journal can grow larger than this value, but at NTFS file system checkpoints the NTFS file system examines the journal and trims it when its size exceeds the value of MaximumSize plus the value of AllocationDelta. (At NTFS file system checkpoints, the operating system writes records to the NTFS file system log file that allow the NTFS file system to determine what processing is required to recover from a failure.)</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">AllocationDelta is the number of bytes added to the end and removed from the beginning of the change journal each time memory is allocated or deallocated. In other words, allocation and deallocation take place in units of this size. An integer multiple of a cluster size is a reasonable value for this member. If an administrator modifies an existing change journal to have a larger MaximumSize value, for example if a volume is being re-indexed too often, the change journal simply receives new entries until it exceeds the new maximum size. To delete a change journal, use the FSCTL_DELETE_USN_JOURNAL control code. When you use this operation, it walks through all of the files on the volume and resets the USN for each file to zero. The operation then deletes the existing change journal. This operation persists across system restarts until it completes. Any attempt to read, create, or modify the change journal during this process fails with the error code ERROR_JOURNAL_DELETE_IN_PROGRESS. You can also use the FSCTL_DELETE_USN_JOURNAL control code to determine if a deletion started by some other process is in progress. For example, your application, when it is started, can determine if a deletion is in progress. Because journal deletions persist across system restarts, services and applications started at system restart should check for an ongoing deletion. Change journals are not necessarily created at startup. To create a change journal, an administrator may do so explicitly or start another service that requires a change journal.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><b><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;;font-weight:bold">Obtaining a Volume Handle for Change Journal Operations</span></font></b></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">To obtain a handle to a volume for use with change journal operations, call the CreateFile() function with the lpFileName parameter set to a string of the following form: <b>\\.\<i><span style="font-style:italic">X</span></i>:</b></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">Note that X is the letter that identifies the drive on which the NTFS volume appears. If the volume does not have a drive letter, use the syntax described in Naming a Volume section.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><b><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;;font-weight:bold">Change Journal Operations</span></font></b></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">The following list identifies the control codes that work with the NTFS file system change journal.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <ol style="margin-top:0mm" start="1" type="1"> <li class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">FSCTL_CREATE_USN_JOURNAL</span></font></li> <li class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">FSCTL_DELETE_USN_JOURNAL</span></font></li> <li class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">FSCTL_ENUM_USN_DATA</span></font></li> <li class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">FSCTL_MARK_HANDLE</span></font></li> <li class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">FSCTL_QUERY_USN_JOURNAL</span></font></li> <li class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">FSCTL_READ_USN_JOURNAL</span></font></li> </ol> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">The following list identifies the structures information that relates to the NTFS file system change journal.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <ol style="margin-top:0mm" start="1" type="1"> <li class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">CREATE_USN_JOURNAL_DATA</span></font></li> <li class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">DELETE_USN_JOURNAL_DATA</span></font></li> <li class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">MARK_HANDLE_INFO</span></font></li> <li class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">MFT_ENUM_DATA</span></font></li> <li class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">READ_USN_JOURNAL_DATA</span></font></li> <li class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">USN_JOURNAL_DATA</span></font></li> <li class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">USN_RECORD</span></font></li> </ol> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt" align="center"> <script type="text/javascript"><!-- google_ad_client = "pub-8089415323104206"; google_ad_slot = "2156170134"; google_ad_width = 728; google_ad_height = 15; //--> </script> &nbsp;<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"> </script></p> <h3 align="center" style="margin-top: 0; margin-bottom: 0"> <font face="Byington"><span style="font-weight: 400">&nbsp; &lt; <a title="Getting Drive Type Program Example" href="windowsvolumeapis1_9.html"> Windows Volume 10</a> | <a title="The Win32 programming tutorial using Visual Studio, C and C++ languages" href="index.html"> Win32 Programming Index</a> | <a title="Windows storage/volume programming tutorials" href="windowsvolumeapis1index.html"> Windows Volume Index</a> | <a title="Walking a Buffer of Change Journal Records C program example" href="windowsvolumeapis1_11.html"> Windows Volume 12</a> &gt;</span></font></h3> <div align="center"> <script src="http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=728X90&cwpid=527221&cwwidth=728&cwheight=90&cwpnet=1&cwtagid=82740"></script> </div> </div> </body> </html>