BY J Zhao
探索 EVERYTHING
背后的技术
获取硬盘上所有文件的方式(想想以前的方式)
监视文件系统变化的方式
并不需要优秀的搜索算法
WHY EVERYTHING FAST ?
Everything 研究之读取NTFS下的USN日志文件
Everything 桌面搜索原理揭秘
Reading MFT @ Microsoft Develop Network
Fsutil usn 命令使用帮助
从 frn 到 full path 的转换, 非公开的 win32 api
Keeping an Eye on Your NTFS Drives: the Windows 2000
Change Journal Explained
Keeping an Eye on Your NTFS Drives, Part II: Building a
Change Journal Application
REFERENCE
① On an NTFS volume, file and directory information is
stored in the Master File Table (MFT).
② With NTFS 5.0, each file's MFT entry records the Last
USN generated for that file.
③ Whenever the file system makes a change to a file or
directory, it appends a record to the journal. The
record identifies the file name, the time of the change,
and what type of change occurred.
CHANGE JOURNAL ON NTFS 5.0
The Change Journal is initially an empty
file on the disk volume. As changes occur
to the volume, records are appended to
the end of this file. Each record is
assigned a 64-bit identifier called an
Update Sequence Number (USN).
INTRODUCE USN