Reading MFT
Also, I have another interest. I've written code to use the Volume Shadowcopy Service (VSS) to create shadowcopies of volumes to enable backup up open files and applications like Exchange. I would...
View ArticleReading MFT
Hi,I've setup http://usnjournal.codeplex.comPlease do contact me if you wish to use it. I am happy to maintain it also if you wish.Cheers.
View ArticleReading MFT
Hi Skipper,I am currently experimenting with your code with some mods and am about to use it in an application. My question is simply, does the USNJournal that I am exploring contain EVERY file on the...
View ArticleReading MFT
I'm not sure I understand your comment. The DeviceIoControl() with FSCTL_READ_USN_JOURNAL reads the raw bytes of the journal.bool bRtn = Win32Api.DeviceIoControl(...
View ArticleReading MFT
is it possible to get all file info: file size, last modified date etc?VB Geek
View ArticleReading MFT
in your latest journal exploert 1.3, there are some missing code, for example, the code file of VolumeSelectDialog.xaml, and resultsLb_Selectionchanged in MainWindow.xamlcould you please provide a...
View ArticleReading MFT
is it possible to gather only a folder, rather than a drive then filter it?VB Geek
View ArticleReading MFT
is MD5 value already in USNJournal so that we can just read it, without calculating by ourselves?VB Geek
View ArticleReading MFT
I've changed a couple of things.1. If you didn't save the USN Journal State before you tried to 'View Changes', it appeared that the app received an error accessing the USN Journal. What actually...
View ArticleReading MFT
I had some time this weekend so I added the code to call NtCreateFile() and NtQueryFileInformation() to get the path and display it in the detail window. This works but I haven't addressed the edge...
View ArticleReading MFT
Obviously right now it appears only you and I are interested in such a project if thats the case then it's a two man job but it's always available to recurit anyone who is interested in the...
View ArticleReading MFT
I tried to download again but it's still corrupt. I am using the dreamincode link. You may want to try uploading to codeplex instead. You could recruit anyone else interested in the project to help...
View ArticleReading MFT
I've already coded in the rights elevation... I've been trying to set up a project in CodeProject. I've gotten one set up but I'm having trouble uploading the code. Which client should I use, and how...
View ArticleReading MFT
Hi, StCroixSkipperI went to review the project but the zip file appears to be corrupt. :( Sure usermode is fine the only problem is that at some point the journal will eventually purge records. What...
View ArticleReading MFT
I've actually written the USN Journal as a service and used it in a product. But what I found is that there is very little value provided by the service. The USN Journal in itself is much like a...
View ArticleReading MFT
Here it is! StCroixSkipper's USN Journal Explorer version 1.0.I would post the code here but it would take three or four posts. You can get the code at...
View ArticleReading MFT
I'm not sure I understand your comment. The DeviceIoControl() with FSCTL_READ_USN_JOURNAL reads the raw bytes of the journal.bool bRtn = Win32Api.DeviceIoControl(...
View ArticleReading MFT
Me too i'm following this ...highly interesting what i'm wondering is why not read the raw mft sectors of the volume and convert those bits and bytes... i guess that's even the fastest possible?i want...
View ArticleReading MFT
Also, I have another interest. I've written code to use the Volume Shadowcopy Service (VSS) to create shadowcopies of volumes to enable backup up open files and applications like Exchange. I would...
View ArticleReading MFT
I found 'OpenFileById' and 'GetFileInformationByHandleEx' in Kernel32.dll and it says "WinBase.h (include Windows.h), FileExtd.h on Windows Server 2003 and Windows XP".So it appears we could get it to...
View Article