Meziantou.FrameworkChangeJournalEntryVersion4 Class
Represents a change journal entry in version 4 format, which includes extent information for modified ranges.
public sealed class ChangeJournalEntryVersion4 : ChangeJournalEntry- Inheritance
ChangeJournalEntryChangeJournalEntryVersion4
Properties
| Name | Description |
|---|---|
| Extents | An array of USN_RECORD_EXTENT structures that represent the extents in the USN_RECORD_V4 entry. |
| ParentReferenceNumber | The ordinal number of the directory where the file or directory that is associated with this record is located. This is an arbitrarily assigned value that associates a journal record with a parent directory. Read more on docs.microsoft.com. |
| Reason | The flags that identify reasons for changes that have accumulated in this file or directory journal record since the file or directory opened. When a file or directory closes, then a final USN record is generated with the USN_REASON_CLOSE flag set. The next change (for example, after the next open operation or deletion) starts a new record with a new set of reason flags. A rename or move operation generates two USN records, one that records the old parent directory for the item, and one that records a new parent. The following table identifies the possible flags. Read more on docs.microsoft.com. |
| ReferenceNumber | The ordinal number of the file or directory for which this record notes changes. This is an arbitrarily assigned value that associates a journal record with a file. Read more on docs.microsoft.com. |
| RemainingExtents | The number of extents that remain after the current USN_RECORD_V4 record. Multiple version 4.0 records may be required to describe all of the modified extents for a given file. When the RemainingExtents member is 0, the current USN_RECORD_V4 record is the last USN_RECORD_V4 record for the file. The last USN_RECORD_V4 entry for a given file is always followed by a USN_RECORD_V3 record with at least the USN_REASON_CLOSE flag set. |
| Source | Additional information about the source of the change, set by the FSCTL_MARK_HANDLE of the DeviceIoControl operation. When a thread writes a new USN record, the source information flags in the prior record continues to be present only if the thread also sets those flags. Therefore, the source information structure allows applications to filter out USN records that are set only by a known source, for example, an antivirus filter. One of the two following values can be set. Read more on docs.microsoft.com. |
| UniqueSequenceNumber | Gets the Unique Sequence Number of this entry. |
An array of USN_RECORD_EXTENT structures that represent the extents in the USN_RECORD_V4 entry.
public IReadOnlyList<ChangeJournalEntryExtent> Extents { get; }Property value
ParentReferenceNumber
ChangeJournalEntryVersion4.csThe ordinal number of the directory where the file or directory that is associated with this record is located. This is an arbitrarily assigned value that associates a journal record with a parent directory.
public FileIdentifier ParentReferenceNumber { get; }Property value
The flags that identify reasons for changes that have accumulated in this file or directory journal record since the file or directory opened. When a file or directory closes, then a final USN record is generated with the USN_REASON_CLOSE flag set. The next change (for example, after the next open operation or deletion) starts a new record with a new set of reason flags. A rename or move operation generates two USN records, one that records the old parent directory for the item, and one that records a new parent. The following table identifies the possible flags.
public ChangeReason Reason { get; }Property value
ReferenceNumber
ChangeJournalEntryVersion4.csThe ordinal number of the file or directory for which this record notes changes. This is an arbitrarily assigned value that associates a journal record with a file.
public FileIdentifier ReferenceNumber { get; }Property value
RemainingExtents
ChangeJournalEntryVersion4.csThe number of extents that remain after the current USN_RECORD_V4 record. Multiple version 4.0 records may be required to describe all of the modified extents for a given file. When the RemainingExtents member is 0, the current USN_RECORD_V4 record is the last USN_RECORD_V4 record for the file. The last USN_RECORD_V4 entry for a given file is always followed by a USN_RECORD_V3 record with at least the USN_REASON_CLOSE flag set.
public uint RemainingExtents { get; }Property value
Additional information about the source of the change, set by the FSCTL_MARK_HANDLE of the DeviceIoControl operation. When a thread writes a new USN record, the source information flags in the prior record continues to be present only if the thread also sets those flags. Therefore, the source information structure allows applications to filter out USN records that are set only by a known source, for example, an antivirus filter. One of the two following values can be set.
public SourceInformation Source { get; }