Quantcast
Channel: Reading MFT
Viewing all articles
Browse latest Browse all 444

Reading MFT

$
0
0

I've changed a couple of things.

1. If you didn't save the USN Journal State before you tried to 'View Changes', it appeared that the app received an error accessing the USN Journal. What actually happened was that no saved usn state was available and I sent a USN Journal ID of zero to the DeviceIoControl() function which produced the error. I now test for a saved usn journal state and if one doesn't exist, I remind you that to 'View Changes' you need a saved usn journal state. Also if there are no changes since the saved usn journal state, I show a 'No entries found' message.

2. It is interesting to view the files shown in the usn entries. So now if you double click on the name or the path, I call the Process.Start() function with the full path. If there is a file extension association for that file it will open that file in the associated application.  If no association exists it will allow you to select an application like NotePad to use to view the file.

I've posted the code at http://www.dreamincode.net/forums/blog/1017/entry-2540-stcroixskippers-usn-journal-explorer-11/


StCroixSkipper

Viewing all articles
Browse latest Browse all 444

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>