NTFS更改日志-文件更改跟踪 [英] NTFS Change Journal - File Change Tracking

问题描述

我正在开发一个更改跟踪软件，以监视特定卷的文件.我尝试了FileSystemWatcher(.NET)和AlternateDataStreams，但是它们都有一些局限性(例如，更改跟踪软件必须是24/7格式，备用数据流不能用于ReadOnly文件等).

I'm developing a change tracking software to monitor files of a specific volume. I tried FileSystemWatcher (.NET) and AlternateDataStreams but they all have some limitations (ie. the change tracking software has to be on 24/7, alternate data streams to not work for ReadOnly files, etc.).

经过一些调查，我认为我可以直接阅读NTFS更改日志.如果在同一卷上移动/重命名文件等，这将非常有用.为了识别文件，我使用了文件参考号.

After some investigations I thought that I could directly read the NTFS change journal. This works great if the file is moved/renamed, etc. on the same volume. For identifying the file I'm using the File Reference Number.

但是，如果将文件移动到另一个卷，则文件参考号自然会更改.

But if the file is moved to another volume, the File Reference Number naturally changes.

我的问题:是否存在即使文件移动到另一个卷也不会更改的唯一ID(GUID或其他名称)?

My question: Is there a unique ID (GUID or something else) that doesn't change even if the file is moved to another volume?

推荐答案

好吧... 可以是文件GUID，但默认情况下不存在.

Well...there can be a file GUID, but it's not there by default.

如果拥有必要的权限，则可以浏览文件并分配一个GUID，该GUID将在NTFS卷移动中保留.您声明的目标正是该功能存在的原因.它使用了一个有点笨拙的API，称为 DeviceIOControl ...，用于繁琐的工作...但其中一个控制代码是FSCTL_CREATE_OR_GET_OBJECT_ID.在此处中进行检查详细信息.

If you have the necessary permissions, you can race through the files and assign a GUID which will be preserved across NTFS volume moves. Your stated goal is exactly why the feature exists. It uses a somewhat unwieldy API called DeviceIOControl...which is used for a gazillion purposes...but one of it's control codes is FSCTL_CREATE_OR_GET_OBJECT_ID. Check here for details.

它仅在尚未分配GUID的情况下创建GUID ...这就是您希望其工作的方式.当然，如果文件移至非NTFS卷，则您仍然不走运.

It only creates the GUID if one hasn't already been assigned...which is just how you want it to work. Of course, if the file moves to a non-NTFS volume, you're still outta luck.

这篇关于NTFS更改日志-文件更改跟踪的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！