Edit

Share via

FSCTL_READ_USN_JOURNAL IOCTL (ntifs.h)

  • Article

The FSCTL_READ_USN_JOURNAL control code retrieves the set of update sequence number (USN) change journal records between two specified USN values. See Remarks.

Major code

FSCTL_READ_USN_JOURNAL

Remarks

There are two control codes that return USN records, FSCTL_READ_USN_JOURNAL and FSCTL_ENUM_USN_DATA. Use the latter when you want a listing (enumeration) of the USN records between two USNs. Use the former when you want to select by USN.

To perform this operation, call FltFsControlFile or ZwFsControlFile with the following parameters.

  • FileObject [in]: Parameter for FltFsControlFile only. A file object pointer for the remote volume. This parameter is required and can't be NULL.

  • FileHandle [in]: Parameter for ZwFsControlFile only. A handle for the remote volume. This parameter is required and can't be NULL.

  • FsControlCode [in]: A control code for the operation. Use FSCTL_READ_USN_JOURNAL for this operation.

  • InputBuffer [in]: Pointer to a READ_USN_JOURNAL_DATA structure.

  • InputBufferLength [in]: Size in bytes of the buffer at InputBuffer.

  • OutputBuffer [out]: Pointer to a USN_RECORD_V2 structure that receives the USN records.

  • OutputBufferLength [in]: Size in bytes of the buffer at OutputBuffer.

FltFsControlFile or ZwFsControlFile returns STATUS_SUCCESS if the operation succeeds. Otherwise, the appropriate function returns the appropriate NTSTATUS error code.

Requirements

Requirement Value
Minimum supported client Windows XP
Header ntifs.h

See also

READ_USN_JOURNAL_DATA_V0

READ_USN_JOURNAL_DATA_V1

USN_RECORD_V2

USN_RECORD_V3

USN_RECORD_V4