1

我想使用 Windows 的更改日志来跟踪一些文件更改。我设法使用示例代码访问所述日记并从中读取记录。我现在面临的问题是该记录只包含相关文件名，而不是它的绝对路径。我尝试将 FSCTL_GET_NTFS_FILE_RECORD 与 DeviceIoControl 一起使用来检查我是否可以通过这种方式获取绝对路径，但是对 DeviceIoControl 的调用总是返回相同的文件记录，缓冲区中有“FILE0”，并且我给它的参考号没有它的 HighPart（例如，我给出的参考编号为 0x001400000015adec，当函数返回时，输出的参考编号为 0x000000000015adec）。

这是我的代码（我在 Windows 10 上运行）

#include <Windows.h>
#include <WinIoCtl.h>
#include <stdio.h>

#define BUF_LEN (1024 * 1024)

void main()
{
    HANDLE hVol;
    CHAR * pBuffer;
    pBuffer = new CHAR[BUF_LEN];

    USN_JOURNAL_DATA JournalData;
    READ_USN_JOURNAL_DATA_V0 ReadData = {0, 0xFFFFFFFF, FALSE, 0, 0};
    PUSN_RECORD UsnRecord;  

    DWORD dwBytes;
    DWORD dwRetBytes;
    DWORD dwFileRecordSize;
    BYTE * pFileRecord;

    hVol = CreateFile( TEXT("\\\\.\\D:"), 
        GENERIC_READ | GENERIC_WRITE, 
        FILE_SHARE_READ | FILE_SHARE_WRITE,
        NULL,
        OPEN_EXISTING,
        0,
        NULL);

    if( hVol == INVALID_HANDLE_VALUE )
    {
        printf("CreateFile failed (%d)\n", GetLastError());
        return;
    }

    if( !DeviceIoControl( hVol, 
        FSCTL_QUERY_USN_JOURNAL, 
        NULL,
        0,
        &JournalData,
        sizeof(JournalData),
        &dwBytes,
        NULL) )
    {
        printf( "Query journal failed (%d)\n", GetLastError());
        return;
    }

    ReadData.UsnJournalID = JournalData.UsnJournalID;

    printf( "Journal ID: %I64x\n", JournalData.UsnJournalID );
    printf( "FirstUsn: %I64x\n\n", JournalData.FirstUsn );

    // get single file record size
    NTFS_VOLUME_DATA_BUFFER volBuffer;
    if( !DeviceIoControl( hVol,
        FSCTL_GET_NTFS_VOLUME_DATA,
        NULL,
        0,
        &volBuffer,
        sizeof(volBuffer),
        &dwBytes,
        NULL))
    {
        printf( "Get volume data size failed (%d)\n", GetLastError());
        return;
    }
    dwFileRecordSize = volBuffer.BytesPerFileRecordSegment + sizeof(NTFS_FILE_RECORD_OUTPUT_BUFFER) - 1;
    pFileRecord = new BYTE[dwFileRecordSize];

    bool bEnd = FALSE;
    WORD lastDay = 0;
    WORD lastMonth = 0;
    WORD lastYear = 0;
    DWORD nbEntries = 0;

    while (!bEnd)
    {
        memset( pBuffer, 0, BUF_LEN );

        if( !DeviceIoControl( hVol, 
            FSCTL_READ_USN_JOURNAL, 
            &ReadData,
            sizeof(ReadData),
            pBuffer,
            BUF_LEN,
            &dwBytes,
            NULL) )
        {
            printf( "Read journal failed (%d)\n", GetLastError());
            return;
        }

        dwRetBytes = dwBytes - sizeof(USN);

        bEnd = (dwRetBytes == 0); // we finished reading the journal

        // Find the first record
        UsnRecord = (PUSN_RECORD)(((PUCHAR)pBuffer) + sizeof(USN));  

        // This loop could go on for a long time, given the current buffer size.
        while( dwRetBytes > 0 )
        {
            SYSTEMTIME systemTime;
            FILETIME fileTime;
            fileTime.dwHighDateTime = UsnRecord->TimeStamp.HighPart;
            fileTime.dwLowDateTime = UsnRecord->TimeStamp.LowPart;
            FileTimeToSystemTime(&fileTime, &systemTime);

            if (lastDay != systemTime.wDay || lastMonth != systemTime.wMonth || lastYear != systemTime.wYear)
            {
                if (nbEntries != 0)
                {
                    printf("%u entries read\n", nbEntries);
                }
                nbEntries = 0;
                lastDay = systemTime.wDay;
                lastMonth = systemTime.wMonth;
                lastYear = systemTime.wYear;
                printf("reading entries for %u/%u/%u...\n", lastDay, lastMonth, lastYear);
            }

            ++nbEntries;

            NTFS_FILE_RECORD_INPUT_BUFFER inputBuff;
            memset(pFileRecord, 0, dwFileRecordSize);
            inputBuff.FileReferenceNumber.QuadPart = UsnRecord->FileReferenceNumber;
            if (!DeviceIoControl( hVol,
                FSCTL_GET_NTFS_FILE_RECORD,
                &inputBuff,
                32,
                pFileRecord,
                dwFileRecordSize,
                &dwBytes,
                NULL))
            {
                printf( "get file record failed (%d)\n", GetLastError());
                return;
            }

            NTFS_FILE_RECORD_OUTPUT_BUFFER * pFileRecordBuff = (NTFS_FILE_RECORD_OUTPUT_BUFFER *)(pFileRecord);
            if (pFileRecordBuff->FileReferenceNumber.QuadPart == inputBuff.FileReferenceNumber.QuadPart)
            {
                printf("file record found\n%.*S\n",
                    pFileRecordBuff->FileRecordLength / 2,
                    pFileRecordBuff->FileRecordBuffer);
            }

            dwRetBytes -= UsnRecord->RecordLength;

            // Find the next record
            UsnRecord = (PUSN_RECORD)(((PCHAR)UsnRecord) + 
                UsnRecord->RecordLength); 
        }
        // Update starting USN for next call
        ReadData.StartUsn = *(USN *)pBuffer; 
    }

    delete[] pBuffer;
    delete[] pFileRecord;

    CloseHandle(hVol);

    system("pause");

}

有什么我做错了吗？还是有另一种方法可以使用 USN_RECORD 实例获取文件的完整路径？

4

2 回答 2

3

OpenFileById您需要首先通过调用函数打开文件句柄FileReferenceNumber（USN_RECORD您不能将它的高 16 位归零！），然后您可以通过GetFileInformationByHandleExwith查询文件路径FileNameInfo。你得到FILE_NAME_INFO了输出。NtQueryInformationFile或通过调用FileNameInformation. 只要文件打开，调用者就可以查询此信息，对DesiredAccess没有任何特殊要求。所以代码看起来像。

ULONG GepPathById(HANDLE hVolumeHint, ULONGLONG FileReferenceNumber, PFILE_NAME_INFO* ppfni)
{
    FILE_ID_DESCRIPTOR fid = { sizeof(fid), FileIdType };
    fid.FileId.QuadPart = FileReferenceNumber;

    HANDLE hFile = OpenFileById(hVolumeHint, &fid, 0, FILE_SHARE_VALID_FLAGS, 0, 0);

    if (hFile == INVALID_HANDLE_VALUE)
    {
        return GetLastError();
    }

    ULONG dwErrorCode = NOERROR;
    ULONG cbNeed = 0x20;
    do 
    {
        if (PFILE_NAME_INFO pfni = (PFILE_NAME_INFO)LocalAlloc(0, cbNeed))
        {
            dwErrorCode = GetFileInformationByHandleEx(hFile, FileNameInfo, 
                pfni, cbNeed - sizeof(WCHAR)) ? 0 : GetLastError();

            if (!dwErrorCode)
            {
                *(PWSTR)((PBYTE)pfni->FileName + pfni->FileNameLength) = 0;
                *ppfni = pfni;
                break;
            }

            cbNeed = FIELD_OFFSET(FILE_NAME_INFO, FileName) + pfni->FileNameLength + sizeof(WCHAR);

            LocalFree(pfni);
        }
        else
        {
            dwErrorCode = GetLastError();
            break;
        }

    } while (dwErrorCode == ERROR_MORE_DATA);

    CloseHandle(hFile);

    return dwErrorCode;
}

和使用

    PFILE_NAME_INFO pfni;
    if (!GepPathById(hVol, UsnRecord->FileReferenceNumber, &pfni))
    {
        DbgPrint("%S\n", pfni->FileName);
        LocalFree(pfni);
    }
于 2018-11-27T22:56:43.570 回答
0 
static FILE_ID_DESCRIPTOR getFileIdDescriptor(const DWORDLONG fileId)
{
    FILE_ID_DESCRIPTOR fileDescriptor;
    fileDescriptor.Type = FileIdType;
    fileDescriptor.FileId.QuadPart = fileId;
    fileDescriptor.dwSize = sizeof(fileDescriptor);
    return fileDescriptor;
}


    FILE_ID_DESCRIPTOR f = getFileIdDescriptor(pRecord->FileReferenceNumber);
    TCHAR wFilePath[MAX_PATH];

    HANDLE handle = OpenFileById(hDevice, (LPFILE_ID_DESCRIPTOR) & (f), 0, 0, 0, 0);
    GetFinalPathNameByHandle(handle, wFilePath, MAX_PATH, 0);
    CloseHandle(handle);
于 2020-10-07T17:44:31.413 回答