using System.Runtime.InteropServices; using Microsoft.Win32.SafeHandles; namespace FastSeek.Core.Mft; internal static class NativeMethods { internal const uint FILE_SHARE_READ = 0x00000001; internal const uint FILE_SHARE_WRITE = 0x00000002; internal const uint FILE_SHARE_DELETE = 0x00000004; internal const uint OPEN_EXISTING = 3; internal const uint FILE_FLAG_BACKUP_SEMANTICS = 0x02000000; internal const uint FILE_FLAG_SEQUENTIAL_SCAN = 0x08000000; internal const uint GENERIC_READ = 0x80000000; internal const uint FILE_BEGIN = 0; internal const uint FSCTL_ENUM_USN_DATA = 0x000900b3; internal const uint FSCTL_QUERY_USN_JOURNAL = 0x000900f4; internal const uint FSCTL_READ_USN_JOURNAL = 0x000900bb; internal const uint USN_REASON_FILE_CREATE = 0x00000100; internal const uint USN_REASON_FILE_DELETE = 0x00000200; internal const uint USN_REASON_RENAME_OLD_NAME = 0x00001000; internal const uint USN_REASON_RENAME_NEW_NAME = 0x00002000; [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)] internal static extern uint GetLogicalDriveStrings(uint nBufferLength, [Out] char[] lpBuffer); [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)] [return: MarshalAs(UnmanagedType.Bool)] internal static extern bool GetVolumeInformation( string lpRootPathName, System.Text.StringBuilder? lpVolumeNameBuffer, uint nVolumeNameSize, out uint lpVolumeSerialNumber, out uint lpMaximumComponentLength, out uint lpFileSystemFlags, [Out] char[] lpFileSystemNameBuffer, uint nFileSystemNameSize); [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)] internal static extern SafeFileHandle CreateFile( string lpFileName, uint dwDesiredAccess, uint dwShareMode, IntPtr lpSecurityAttributes, uint dwCreationDisposition, uint dwFlagsAndAttributes, IntPtr hTemplateFile); [DllImport("kernel32.dll", SetLastError = true)] [return: MarshalAs(UnmanagedType.Bool)] internal static extern bool ReadFile( SafeFileHandle hFile, [Out] byte[] lpBuffer, uint nNumberOfBytesToRead, out uint lpNumberOfBytesRead, IntPtr lpOverlapped); [DllImport("kernel32.dll", SetLastError = true)] [return: MarshalAs(UnmanagedType.Bool)] internal static extern bool SetFilePointerEx(SafeFileHandle hFile, long liDistanceToMove, out long lpNewFilePointer, uint dwMoveMethod); [DllImport("kernel32.dll", SetLastError = true)] [return: MarshalAs(UnmanagedType.Bool)] internal static extern bool DeviceIoControl( SafeFileHandle hDevice, uint dwIoControlCode, IntPtr lpInBuffer, uint nInBufferSize, [Out] byte[] lpOutBuffer, uint nOutBufferSize, out uint lpBytesReturned, IntPtr lpOverlapped); [DllImport("kernel32.dll", SetLastError = true)] [return: MarshalAs(UnmanagedType.Bool)] internal static extern bool DeviceIoControl( SafeFileHandle hDevice, uint dwIoControlCode, IntPtr lpInBuffer, uint nInBufferSize, IntPtr lpOutBuffer, uint nOutBufferSize, out uint lpBytesReturned, IntPtr lpOverlapped); } [StructLayout(LayoutKind.Sequential)] internal struct MftEnumDataV0 { public ulong StartFileReferenceNumber; public long LowUsn; public long HighUsn; } [StructLayout(LayoutKind.Sequential)] internal struct UsnJournalDataV0 { public ulong UsnJournalID; public long FirstUsn; public long NextUsn; public long LowestValidUsn; public long MaxUsn; public ulong MaximumSize; public ulong AllocationDelta; } [StructLayout(LayoutKind.Sequential)] internal struct ReadUsnJournalDataV0 { public long StartUsn; public uint ReasonMask; public uint ReturnOnlyOnClose; public ulong Timeout; public ulong BytesToWaitFor; public ulong UsnJournalID; } [StructLayout(LayoutKind.Sequential)] internal struct UsnRecordV2 { public uint RecordLength; public ushort MajorVersion; public ushort MinorVersion; public ulong FileReferenceNumber; public ulong ParentFileReferenceNumber; public long Usn; public long TimeStamp; public uint Reason; public uint SourceInfo; public uint SecurityId; public uint FileAttributes; public ushort FileNameLength; public ushort FileNameOffset; }