如何比较2卷和列出修改的文件？ [英] How to compare 2 volumes and list modified files?

问题描述

我有2个硬盘卷（一个是另一个的备份映像），我要比较卷并列出所有修改的文件，以便用户可以选择他/她想要回滚的卷。

I have 2 hard-disk volumes(one is a backup image of the other), I want to compare the volumes and list all the modified files, so that the user can select the ones he/she wants to roll-back.

目前我正在通过新卷进行递归，并将每个文件的时间戳与旧卷的文件（如果它们在旧卷中）进行比较。显然这是一个错误的方法。

Currently I'm recursing through the new volume and comparing each file's time-stamps to the old volume's files (if they are int the old volume). Obviously this is a blunder approach. It's time consuming and wrong!

有没有有效的方法？

>
- 我使用FindFirstFile并且喜欢递归卷，并收集每个文件的信息（不是很慢，只有几分钟）。

- 我使用卷阴影复制到备份。

- 备份卷是远程的，因此我无法连续监视实际卷。

- I'm using FindFirstFile and likes to recurse the volume, and gather info of each file (not very slow, just a few minutes).
- I'm using Volume Shadow Copy to backup.
- The backup-volume is remote so I cannot continuously monitor the actual volume.

推荐答案

这部分取决于两个卷是如何复制的;如果它们是从文件系统的角度来看的真副本（例如，卷影副本或其他块级副本），您可以对USN做一些棘手的小事，这是其他人建议您查看的一般技术。您可能需要查看像 FSCTL_READ_FILE_USN_DATA 。该API将允许您比较文件的两个不同副本（同样，假设它们是与来自块级备份的相同文件引用号的相同的文件）。如果你想成为大部分无状态的，这个和类似的API将帮助你在这里。我的算法看起来像这样：

Part of this depends upon how the two volumes are duplicated; if they are 'true' copies from the file system's point of view (e.g. shadow copies or other block-level copies), you can do a few tricky little things with respect to USN, which is the general technology others are suggesting you look into. You might want to look at an API like FSCTL_READ_FILE_USN_DATA, for example. That API will let you compare two different copies of a file (again, assuming they are the same file with the same file reference number from block-level backups). If you wanted to be largely stateless, this and similar APIs would help you a lot here. My algorithm would look something like this:

foreach( file in backup_volume ) {
    file_still_exists = try_open_by_id( modified_volume )
    if (file_still_exists) {
        usn_result = compare_usn_values_of_files( file, file_in_modified_volume )
        if (usn_result == equal_to) {
           // file hasn't changed at all
        } else {
           // file has changed (somehow)
        }
    } else {
        // file was deleted (possibly deleted and recreated)
    }
}
// we still don't know about files new in modified_volume

说，我的经验导致我相信这将比我的袖口解释提示更复杂。这可能是一个很好的起点。

All of that said, my experience leads me to believe that this will be more complicated than my off-the-cuff explanation hints at. This might be a good starting place, though.

如果卷不是彼此的块级副本，那么将很难比较USN号和文件ID，如果不是不可能的。相反，你可能很好的文件名，这将是困难的，如果不是不可能做到没有打开每个文件（时间可以修改应用程序，大小和时间可能过时的findfirst /下一个查询，而你必须处理删除然后重新创建的案例，重命名案例等）。

If the volumes are not block-level copies of one another, then it will be very difficult to compare USN numbers and file IDs, if not impossible. Instead, you may very well be going by file name, which will be difficult if not impossible to do without opening every file (times can be modified by apps, sizes and times can be out of date in the findfirst/next queries, and you have to handle deleted-then-recreated cases, rename cases, etc.).

所以知道你对环境的控制是非常重要的。

So knowing how much control you have over the environment is pretty important.

这篇关于如何比较2卷和列出修改的文件？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！