Meziantou.FrameworkChangeJournalEntryVersion2or3 Class
Represents a change journal entry in version 2 or version 3 format.
public sealed class ChangeJournalEntryVersion2or3 : ChangeJournalEntry- Inheritance
ChangeJournalEntryChangeJournalEntryVersion2or3
Properties
| Name | Description |
|---|---|
| Attributes | The attributes for the file or directory associated with this record, as returned by the GetFileAttributes function. Attributes of streams associated with the file or directory are excluded. Read more on docs.microsoft.com. |
| Name | The name of the file or directory associated with this record in Unicode format. This file or directory name is of variable length. When working with FileName, do not count on the file name that contains a trailing '\0' delimiter, but instead determine the length of the file name by using FileNameLength. Do not perform any compile-time pointer arithmetic using FileName. Instead, make necessary calculations at run time by using the value of the FileNameOffset member. Doing so helps make your code compatible with any future versions of USN_RECORD_V2. Read more on docs.microsoft.com. |
| ParentReferenceNumber | The ordinal number of the directory where the file or directory that is associated with this record is located. This is an arbitrarily assigned value that associates a journal record with a parent directory. Read more on docs.microsoft.com. |
| Reason | The flags that identify reasons for changes that have accumulated in this file or directory journal record since the file or directory opened. When a file or directory closes, then a final USN record is generated with the USN_REASON_CLOSE flag set. The next change (for example, after the next open operation or deletion) starts a new record with a new set of reason flags. A rename or move operation generates two USN records, one that records the old parent directory for the item, and one that records a new parent. The following table identifies the possible flags. This doc was truncated. Read more on docs.microsoft.com. |
| ReferenceNumber | The ordinal number of the file or directory for which this record notes changes. This is an arbitrarily assigned value that associates a journal record with a file. Read more on docs.microsoft.com. |
| SecurityId | The unique security identifier assigned to the file or directory associated with this record. |
| Source | Additional information about the source of the change, set by the FSCTL_MARK_HANDLE of the DeviceIoControl operation. When a thread writes a new USN record, the source information flags in the prior record continues to be present only if the thread also sets those flags. Therefore, the source information structure allows applications to filter out USN records that are set only by a known source, for example, an antivirus filter. One of the two following values can be set. Read more on docs.microsoft.com. |
| TimeStamp | The standard UTC time stamp (FILETIME) of this record, in 64-bit format. Read more on docs.microsoft.com. |
| UniqueSequenceNumber | Gets the Unique Sequence Number of this entry. |
Attributes
ChangeJournalEntryVersion2or3.csThe attributes for the file or directory associated with this record, as returned by the GetFileAttributes function. Attributes of streams associated with the file or directory are excluded.
public FileAttributes Attributes { get; }Property value
The name of the file or directory associated with this record in Unicode format. This file or directory name is of variable length. When working with FileName, do not count on the file name that contains a trailing '\0' delimiter, but instead determine the length of the file name by using FileNameLength. Do not perform any compile-time pointer arithmetic using FileName. Instead, make necessary calculations at run time by using the value of the FileNameOffset member. Doing so helps make your code compatible with any future versions of USN_RECORD_V2.
public string Name { get; }Property value
ParentReferenceNumber
ChangeJournalEntryVersion2or3.csThe ordinal number of the directory where the file or directory that is associated with this record is located. This is an arbitrarily assigned value that associates a journal record with a parent directory.
public FileIdentifier ParentReferenceNumber { get; }Property value
The flags that identify reasons for changes that have accumulated in this file or directory journal record since the file or directory opened. When a file or directory closes, then a final USN record is generated with the USN_REASON_CLOSE flag set. The next change (for example, after the next open operation or deletion) starts a new record with a new set of reason flags. A rename or move operation generates two USN records, one that records the old parent directory for the item, and one that records a new parent. The following table identifies the possible flags.
This doc was truncated.
public ChangeReason Reason { get; }Property value
ReferenceNumber
ChangeJournalEntryVersion2or3.csThe ordinal number of the file or directory for which this record notes changes. This is an arbitrarily assigned value that associates a journal record with a file.
public FileIdentifier ReferenceNumber { get; }Property value
SecurityId
ChangeJournalEntryVersion2or3.csAdditional information about the source of the change, set by the FSCTL_MARK_HANDLE of the DeviceIoControl operation. When a thread writes a new USN record, the source information flags in the prior record continues to be present only if the thread also sets those flags. Therefore, the source information structure allows applications to filter out USN records that are set only by a known source, for example, an antivirus filter. One of the two following values can be set.
public SourceInformation Source { get; }Property value
TimeStamp
ChangeJournalEntryVersion2or3.csUniqueSequenceNumber
ChangeJournalEntryVersion2or3.csMethods
| Name | Description |
|---|---|
| ToString() |