4

I'm seeking to use Change Journal instead of ReadDirectoryChangesW to track changes in my delphi XE2 application (as for why: ReadDirectoryChangesW is not that reliable)

The closest I could find in delphi/pascal is something called Delphi MFT/Journal helpers, it contains two pascal units: uMFT.pas and uDevNotification.pas.

The code above deal with MFT (very nicely actually), but nothing as far change journal goes.

I also found this C# code, which seems to do what I want, only it's in C#

My question is: anyone knows a Delphi XE2 code (or how to convert the C# code) to interact with and/or query the change journal?

As I said, my goal is to replace the ReadDirectoryChangesW, so I ultimately need to interact with the change journal so that I'm notified whenever there's a change in the filesystem

TheDude
  • 3,045
  • 4
  • 46
  • 95
  • And are you sure that this is what you want to do? It only applies to NTFS file systems. I'm not sure if it will work for network volumes. And the app will require admin rights to access a volume wide change journal. – David Heffernan Jan 24 '13 at 09:11
  • @DavidHeffernan Good points: my app *already* requires admin access and, in this case, `ReadDirectoryChangesW` would be the fallback solution (the uMFT does detect NTFS volumes). Supporting network volumes would be nice, but not really important right now. – TheDude Jan 24 '13 at 09:27
  • 1
    `uMFT.pas` has `QueryUSNJournal()` and `EnumMFTEntries()` functions for accessing the records of the Change Journal. Did you actually try using them yet? The MFT naming is just because the Master File Table uses the same record format as the Change Journal, so the same code can be used to enumerate records in both tables. – Remy Lebeau Jan 24 '13 at 09:31
  • 2
    Did you look at these articles: http://www.microsoft.com/msj/0999/journal/journal.aspx http://www.microsoft.com/msj/1099/journal2/journal2.aspx Frankly if you want to do low-level stuff like this you need to be skilled enough to port from C++ code to Delphi. It should be easy enough I think. – David Heffernan Jan 24 '13 at 09:32
  • @RemyLebeau: I **did** use `EnumMFTEntries` but I missed `QueryUSNJournal`. I'll study it, but it seems the way to go [according to this description](http://stackoverflow.com/questions/4203573/finding-a-set-of-file-names-quickly-on-ntfs-volumes-ideally-via-its-mft?rq=1#comment4601591_4244046)...Do I take it the change journal has no notification mechanism? – TheDude Jan 24 '13 at 09:41
  • @DavidHeffernan: No I didn't, thank a lot, I'll take a look at them – TheDude Jan 24 '13 at 09:41
  • 1
    @DavidHeffernan: (thinking out loud here...) Since the change journal has no notification mechanism (or so it seems), I could probably still rely on `ReadDirectoryChangesW` to catch changes, and **then** use the changes journal to reliably get the modification date. That would fix [my other issue](http://stackoverflow.com/questions/14487764/delphi-overwrite-file-and-wrong-modified-date-time) about the unreliable file modification time. Does that make sense? – TheDude Jan 24 '13 at 09:53
  • 3
    Yes, that makes good sense. – David Heffernan Jan 24 '13 at 10:11
  • Please note that in 64-bit applications uMFT.pas will not work reliably any more. You will have to replace the Integer/Cardinal casts with their NativeInt/NativeUInt counterparts. Unfortunately you will not notice this if GetMem by chance will choose a low memory address. – stackmik May 13 '20 at 15:24

0 Answers0