在NTFS卷上快速找到一组文件名，最好是通过MFT [英] Finding a set of file names quickly on NTFS volumes, ideally via its MFT
问题描述
我正在编写一个工具，用于查找Mac和Windows的iTunes资料库的丢失文件。在Mac上，我可以使用美妙的CatalogSearch函数快速找到文件。
然而，在Windows上，似乎没有用于通过文件搜索的OS API （或是否存在？）。
经过一些Google搜索之后，我了解到有一些工具（如 TFind ， Everything 直接读取NTFS目录并扫描它以查找文件的名称。
我也想这样做，但不必从头开始（尽管我以前写过不少的磁盘工具，我从来没有精力去挖掘NTFS）。
不知有没有现成的库可能作为一个.dll，这会给我这个搜索功能：传入一个文件名，找回它的路径。
或者，Windows索引服务？至少当我在最近安装的XP Home系统上试过这个时，在 Start 菜单下的 Search 操作实际上会扫描所有的目录，这表明它没有完整的数据库。因为我不是一个Windows用户，我想知道为什么这不起作用。
最后， complete 解决方案I需要的是：我有一个文件名列表来查找，我需要搜索整个磁盘（或使用数据库）的代码来一次性得到所有结果。例如，搜索不应该为我查找的每个文件启动新的全面扫描。这就是为什么我认为MFT的方式是最佳的，因为它可以快速遍历所有的名字，比较每个名单。
解决方案解决您的问题的最佳方法似乎是使用Windows更改日记。
问题：如果未启用卷或者卷是非卷NTFS你需要一个回退（或启用更改日记，如果它是NTFS）。您需要管理员权限才能访问更改日志。
使用LowUsn = 0的FSCTL_ENUM_USN_DATA和DeviceIOControll获取文件。这直接访问MFT并将所有文件名写入提供的缓冲区。因为它顺序地执行MFT，所以比FindFirstFile API快。
I am in the middle of writing a tool that finds lost files of an iTunes library, for both Mac and Windows. On the Mac, I can quickly find files by naming using the wonderful "CatalogSearch" function.
On Windows, however, there seems to be no OS API for searching by file name (or is there?).
After some googling, I learned that there are tools (like TFind, Everything) that read the NTFS directory directly and scan it to find files by name.
I would like to do the same, but without having to start from scratch (although I've written quite a few disk tools in the past, I've never had the energy to dig into NTFS).
I wonder if there are ready-made libs around, possibly as a .dll, that would give me this search feature: Pass in a file name, get back its path.
Alternatively, what about the Windows indexing service? At least when I tried this on a recently installed XP Home system, the Search operation under the Start menu would actually scan all directories, which suggests that it has no complete database. As I'm not a Windows user at all, I wonder why this isn't working.
In the end, the complete solution I need is: I have a list of file names to find, and I need code that searches the entire disk (or uses a DB for it) to get me all results in one go. E.g, the search should not start a new full scan for every file I'm looking up. That's why I think the MFT way would be optimal, as it could quickly iterate over all names, comparing each to my list.
The best way to solve your problem seems to be by using the Windows Change Journal.
Problem: If it is not enabled for a volume or the volume is a non-NTFS you need a fallback (or enable the Change Journal if it is NTFS). You need administrator rights as well to access the Change Journal.
You get the files by using the FSCTL_ENUM_USN_DATA and DeviceIOControll with LowUsn=0. This directly accesses the MFT and writes all filenames into the supplied buffer. Because it sequentially acesses the MFT it is faster than the FindFirstFile API.
这篇关于在NTFS卷上快速找到一组文件名，最好是通过MFT的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
