Reading MFT
I've actually done it both ways. Given a File Reference Number you can to full path. I used Dictionary in this case because it has the advantage of being faster but it certainly takes up more memory....
View ArticleReading MFT
USN_RECORDS return only FileNames this is to reserve as much space possible in the change log. You can map (fileReference) or (ParentFileReference) to complete paths using API. This approach is so much...
View ArticleReading MFT
I think I've figured out how to use it reliably. Have found solution for .NET?
View ArticleReading MFT
Hi StCroixSkipper . First of all i would like to thank you for this post. It helped me a lot in my project. And I'm really interested in using USN from c#! I'm currently investigating this question to,...
View ArticleReading MFT
Hey guys, great thread and especially great snippets!Currently I am working on an application that basically has to be able to undelete data from both NTFS and FAT32 drives.I've started working on the...
View ArticleReading MFT
StCroixSkipper said:Is anyone interested in using the USN Journal from C#?Sure I am. What do you have in your sleeve?AlexB
View ArticleReading MFT
Thanks Skipper. It's an embarrassing oversight. It was correct at one point but then I refactored it manually and apparently goofed up. Anyhow, now it seems to be working but I am getting an error:...
View ArticleReading MFT
Just looking at your code ...private Dictionary<UInt64, FileNameAndFrn> directories_ = newDictionary<ulong, FileNameAndFrn> ( );publicDictionary<UInt64, FileNameAndFrn> directories{...
View ArticleReading MFT
Skipper, I finally got it compiled. Your last comment opened my eyes on the relationships. Now I am getting a runtime stack overflow error on this statement:privateDictionary<UInt64,...
View ArticleReading MFT
Glad it works for you. I like your name change mft. It makes sense. Then next challenge is to use the change journal to identify changes to the volume without doing a findfirst/findnext for the...
View ArticleReading MFT
Garethbradley, welcome to the fray. I feel you've resolved the last remaining issue I've struggled with but you also introduced a new mystery. What is MFT.cs file with MFT class in it? Is it something...
View ArticleReading MFT
StCroixSkipper, Can I say a big thank you! It took a bit of work, but I came up with the following:PInvokeWin32.cs - as described on Page 1 of this thread.Log.cs - A quick Log class that writes out a...
View ArticleReading MFT
Well, in deference to you, Skipper, and out of profound respect (you've attained a mythical status in my eyes:) I will change the name FileNameAndFrn to FileNameAndParentFrn tomorow, that will make...
View ArticleReading MFT
I just got back from an 8 day hiking trip through Wyoming's Wind Rivers Wilderness area. So I have just started to catch up on email and other details. Caught a lot of fish, saw some great country,...
View ArticleReading MFT
Bump.Skipper, is there any hope to get your attention? I just completed a full project and am about to get back to Master Record stuff. Would appreciate your help.Thanks.AlexB
View ArticleReading MFT
OK, Skipper, I hope you pilot a rescue craft of a good size. I count on you. I ve made some progress but naturally got in trouble as well. Before I begin I want to mention that I think it is odd that...
View ArticleReading MFT
Skipper, I appreciate it very much. Now I know, you are a true captain:)AlexB
View Article