DeviceIOControl FSCTL_ENUM_USN_DATA gives error 1 Incorrect Functi

G

Guest

We are successfully getting a handle to a drive using createfile then using that handle to query the change journal using DeviceIOControl with the paramter FSCTL_QUERY_USN_DATA. However when we try to enumerate the change journal data using the same handle and using DeviceIOControl with FSCTL_ENUM_DATA it gives error 1 Incorrect function. The help says this means that the drive does not support change journals but this is not the case as we can query the change journal successfully. The code is below. ahandle is a valid handle (we know this becuase we can use it successfully to query the change journal) and ujd is our output buffer from FSCTL_QUERY_USN_DATA, containing valid values. Does anyone know why we are getting error 1?

Public Const FILE_READ_DATA = &H1
Public Const FILE_DEVICE_FILE_SYSTEM = &H9
Public Const METHOD_NEITHER = &H3

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Auto)> Public Structure MFT_ENUM_DATA
Public StartFileReferenceNumber As Long
Public LowUsn As Int64
Public HighUsn As Int64
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Auto)> Public Structure ENUM_USN_DATA
Public USN As Int64
Public RECORD As USN_RECORD
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Auto)> Public Structure USN_RECORD
Dim RecordLength As Integer
Dim MajorVersion As Integer
Dim MinorVersion As Integer
Dim FileReferenceNumber As Integer
Dim ParentFileReferenceNumber As Integer
Dim Usn As Integer
Dim TimeStamp As Integer
Dim Reason As Integer
Dim SourceInfo As Integer
Dim SecurityId As Integer
Dim FileAttributes As Integer
Dim FileNameLength As Integer
Dim FileNameOffset As Integer
Dim FileName As String
End Structure

Public Declare Function DeviceIoControl Lib "kernel32.dll" (ByVal hDevice As IntPtr, ByVal dwIoControlCode As Int32, <MarshalAs(UnmanagedType.Struct)> ByRef lpInBuffer As MFT_ENUM_DATA, ByVal nInBufferSize As Integer, <MarshalAs(UnmanagedType.Struct)> ByRef lpOutBuffer As ENUM_USN_DATA, ByVal nOutBufferSize As Integer, ByRef lpBytesReturned As Integer, ByVal lpOverlapped As Integer) As IntPtr

Public Sub QueryJournal()
Dim FSCTL_ENUM_USN_DATA As Long = CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 44, METHOD_NEITHER, FILE_READ_DATA)
EnumDataBufferIn.StartFileReferenceNumber = 0
EnumDataBufferIn.LowUsn = ujd.LowestValidUsn
EnumDataBufferIn.HighUsn = ujd.NextUsn
anObject = DeviceIoControl(aHandle, FSCTL_ENUM_USN_DATA, EnumDataBufferIn, Marshal.SizeOf(EnumDataBufferIn), EUSN, Marshal.SizeOf(EUSN), byteBack, 0)
end sub

Public Function CTL_CODE(ByVal dwDeviceType As Long, _
ByVal dwFunction As Long, _
ByVal dwMethod As Long, _
ByVal dwAccess As Long) As Long

On Error GoTo Out

CTL_CODE = ShiftBits(dwDeviceType, 16) Or _
ShiftBits(dwAccess, 14) Or _
ShiftBits(dwFunction, 2) Or dwMethod

Out:
End Function
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top