C++ USN日志 相关的代码

例子一：

TestApp.cpp

#include <set>
#include "USNMethod.h"

using namespace std;

int main()
{
	// 获得所有变化记录
	deque<MY_USN_RECORD> con;
	EnumUsnRecord( "F", con );

	// 搜寻文件名为"testXML.xml"的文件号（可能有多个）
	set<DWORDLONG> con2;
	for( deque<MY_USN_RECORD>::const_iterator itor=con.begin(); itor!=con.end(); ++itor )
	{
		const MY_USN_RECORD& mur = *itor;
		if( _wcsicmp(mur.FileName,L"testXML.xml") == 0 )
		{
			con2.insert( mur.FileReferenceNumber );
		}
	}

	// 遍历其历史操作
	setlocale( LC_CTYPE, "chs" );
	for( set<DWORDLONG>::const_iterator itor2=con2.begin(); itor2!=con2.end(); ++itor2 )
	{
		for( deque<MY_USN_RECORD>::const_iterator itor=con.begin(); itor!=con.end(); ++itor )
		{
			const MY_USN_RECORD& mur = *itor;
			if( *itor2 == mur.FileReferenceNumber )
			{
				FILETIME timestamp;
				FileTimeToLocalFileTime( &(FILETIME&)mur.TimeStamp, &timestamp );
				SYSTEMTIME st;
				FileTimeToSystemTime( &timestamp, &st );
				printf( "%04d-%02d-%02d %02d:%02d:%02d " , st.wYear, st.wMonth, st.wDay, st.wHour, st.wMinute, st.wSecond );

				if( mur.Reason&USN_REASON_DATA_OVERWRITE )
				{
					printf( "%s|", "DATA_OVERWRITE" );
				}
				if( mur.Reason&USN_REASON_DATA_EXTEND )
				{
					printf( "%s|", "DATA_EXTEND" );
				}
				if( mur.Reason&USN_REASON_DATA_TRUNCATION )
				{
					printf( "%s|", "DATA_TRUNCATION" );
				}
				if( mur.Reason&USN_REASON_NAMED_DATA_OVERWRITE )
				{
					printf( "%s|", "NAMED_DATA_OVERWRITE" );
				}
				if( mur.Reason&USN_REASON_NAMED_DATA_EXTEND )
				{
					printf( "%s|", "NAMED_DATA_EXTEND" );
				}
				if( mur.Reason&USN_REASON_NAMED_DATA_TRUNCATION )
				{
					printf( "%s|", "NAMED_DATA_TRUNCATION" );
				}
				if( mur.Reason&USN_REASON_FILE_CREATE )
				{
					printf( "%s|", "FILE_CREATE" );
				}
				if( mur.Reason&USN_REASON_FILE_DELETE )
				{
					printf( "%s|", "FILE_DELETE" );
				}
				if( mur.Reason&USN_REASON_EA_CHANGE )
				{
					printf( "%s|", "EA_CHANGE" );
				}
				if( mur.Reason&USN_REASON_SECURITY_CHANGE )
				{
					printf( "%s|", "SECURITY_CHANGE" );
				}
				if( mur.Reason&USN_REASON_RENAME_OLD_NAME )
				{
					printf( "%s|", "RENAME_OLD_NAME" );
				}
				if( mur.Reason&USN_REASON_RENAME_NEW_NAME )
				{
					printf( "%s|", "RENAME_NEW_NAME" );
				}
				if( mur.Reason&USN_REASON_INDEXABLE_CHANGE )
				{
					printf( "%s|", "INDEXABLE_CHANGE" );
				}
				if( mur.Reason&USN_REASON_BASIC_INFO_CHANGE )
				{
					printf( "%s|", "BASIC_INFO_CHANGE" );
				}
				if( mur.Reason&USN_REASON_HARD_LINK_CHANGE )
				{
					printf( "%s|", "HARD_LINK_CHANGE" );
				}
				if( mur.Reason&USN_REASON_COMPRESSION_CHANGE )
				{
					printf( "%s|", "COMPRESSION_CHANGE" );
				}
				if( mur.Reason&USN_REASON_ENCRYPTION_CHANGE )
				{
					printf( "%s|", "ENCRYPTION_CHANGE" );
				}
				if( mur.Reason&USN_REASON_OBJECT_ID_CHANGE )
				{
					printf( "%s|", "OBJECT_ID_CHANGE" );
				}
				if( mur.Reason&USN_REASON_REPARSE_POINT_CHANGE )
				{
					printf( "%s|REPARSE_POINT_CHANGE", "" );
				}
				if( mur.Reason&USN_REASON_STREAM_CHANGE )
				{
					printf( "%s|", "STREAM_CHANGE" );
				}
				if( mur.Reason&USN_REASON_TRANSACTED_CHANGE )
				{
					printf( "%s|", "TRANSACTED_CHANGE" );
				}
				if( mur.Reason&USN_REASON_CLOSE )
				{
					printf( "%s|", "CLOSE" );
				}

				printf( "\n  " );
				bool PrintFullPath( const MY_USN_RECORD& mur, const deque<MY_USN_RECORD>& con );
				PrintFullPath(mur,con);
				printf( "\n" );
			}
		}
		printf( "\n" );
	}

	if( hVol != INVALID_HANDLE_VALUE )
	{
		CloseHandle( hVol );
	}

	return 0;
}

bool PrintFullPath( const MY_USN_RECORD& mur, const deque<MY_USN_RECORD>& con )
{
	if( (mur.FileReferenceNumber&0x0000FFFFFFFFFFFF) == 5 )
		return true;

	deque<MY_USN_RECORD>::const_iterator recent = con.end();
	for( deque<MY_USN_RECORD>::const_iterator itor=con.begin(); itor!=con.end() && itor->TimeStamp.QuadPart<=mur.TimeStamp.QuadPart; ++itor )
	{
		if( itor->FileReferenceNumber == mur.ParentFileReferenceNumber )
			recent = itor;
	}
	// 它的父目录可能也已被删除，所以要先在记录集中找找
	if( recent != con.end() ) 
	{
		bool r= PrintFullPath(*recent,con);
		printf( "\\%S", mur.FileName );
		return r;
	}

	bool GetFullPathByFileReferenceNumber( HANDLE hVol, DWORDLONG FileReferenceNumber );
	// 如果记录中没有，再去看看这个文件实际存在否
	bool r = GetFullPathByFileReferenceNumber(hVol,mur.ParentFileReferenceNumber); 
	if( r )	{
		printf( "\\%S", mur.FileName );
	} else {
		printf( "???\\%S", mur.FileName );
	}
	return r;
}

bool GetFullPathByFileReferenceNumber( HANDLE hVol, DWORDLONG FileReferenceNumber )
{
	if( (FileReferenceNumber&0x0000FFFFFFFFFFFF) == 5 ){
		return true;
	}

	bool ret = false;
	DWORD BytesReturned;
	NTFS_VOLUME_DATA_BUFFER nvdb;
	// 仅是事例，没有作优化 1.作为递归调用，这一步应当提取出来 2.如果多次调用，DirectoryFileReferenceNumber没必要被重复获取
	if( DeviceIoControl( hVol, FSCTL_GET_NTFS_VOLUME_DATA, NULL, 0
		, &nvdb, sizeof(nvdb), &BytesReturned, NULL ) ) 
	{
		NTFS_FILE_RECORD_INPUT_BUFFER nfrib;
		nfrib.FileReferenceNumber.QuadPart = FileReferenceNumber;
		size_t len = sizeof(NTFS_FILE_RECORD_OUTPUT_BUFFER)+nvdb.BytesPerFileRecordSegment-1;
		NTFS_FILE_RECORD_OUTPUT_BUFFER* nfrob = (PNTFS_FILE_RECORD_OUTPUT_BUFFER)operator new(len);
		if( DeviceIoControl( hVol, FSCTL_GET_NTFS_FILE_RECORD, &nfrib, sizeof(nfrib)
			, nfrob, len, &BytesReturned, NULL ) )
		{
			// a 48-bit index and a 16-bit sequence number
			if( (nfrib.FileReferenceNumber.QuadPart&0x0000FFFFFFFFFFFF) == nfrob->FileReferenceNumber.QuadPart )
			{
				PFILE_RECORD_HEADER frh = (PFILE_RECORD_HEADER)nfrob->FileRecordBuffer;
				for( PATTRIBUTE attr=(PATTRIBUTE)((LPBYTE)frh+frh->AttributesOffset); attr->AttributeType!=-1; attr=(PATTRIBUTE)((LPBYTE)attr+attr->Length) )
				{
					if( attr->AttributeType == AttributeFileName )
					{
						PFILENAME_ATTRIBUTE name = (PFILENAME_ATTRIBUTE)( (LPBYTE)attr + PRESIDENT_ATTRIBUTE(attr)->ValueOffset );
						// long name
						if( (name->NameType&1) == 1 )
						{
							if( GetFullPathByFileReferenceNumber( hVol, name->DirectoryFileReferenceNumber ) )
							{
								printf( "\\%.*S", name->NameLength, name->Name );
								ret = true;
							}
						}
					}
				}
			}
		}
		operator delete( nfrob );
	}
	return ret;
}

 

USNMethod.h

#define _CRT_SECURE_NO_WARNINGS
#include <windows.h>
#include <string>
#include <deque>

using namespace std;

struct MY_USN_RECORD
{
	DWORDLONG FileReferenceNumber;
	DWORDLONG ParentFileReferenceNumber;
	LARGE_INTEGER TimeStamp;
	DWORD Reason;
	WCHAR FileName[MAX_PATH];
};


typedef struct {
	ULONG Type;
	USHORT UsaOffset;
	USHORT UsaCount;
	USN Usn;
} NTFS_RECORD_HEADER, *PNTFS_RECORD_HEADER;

typedef struct {
	NTFS_RECORD_HEADER Ntfs;
	USHORT SequenceNumber;
	USHORT LinkCount;
	USHORT AttributesOffset;
	USHORT Flags;               // 0x0001 = InUse, 0x0002 = Directory
	ULONG BytesInUse;
	ULONG BytesAllocated;
	ULONGLONG BaseFileRecord;
	USHORT NextAttributeNumber;
} FILE_RECORD_HEADER, *PFILE_RECORD_HEADER;

typedef enum {
	AttributeStandardInformation = 0x10,
	AttributeAttributeList = 0x20,
	AttributeFileName = 0x30,
	AttributeObjectId = 0x40,
	AttributeSecurityDescriptor = 0x50,
	AttributeVolumeName = 0x60,
	AttributeVolumeInformation = 0x70,
	AttributeData = 0x80,
	AttributeIndexRoot = 0x90,
	AttributeIndexAllocation = 0xA0,
	AttributeBitmap = 0xB0,
	AttributeReparsePoint = 0xC0,
	AttributeEAInformation = 0xD0,
	AttributeEA = 0xE0,
	AttributePropertySet = 0xF0,
	AttributeLoggedUtilityStream = 0x100
} ATTRIBUTE_TYPE, *PATTRIBUTE_TYPE;

typedef struct {
	ATTRIBUTE_TYPE AttributeType;
	ULONG Length;
	BOOLEAN Nonresident;
	UCHAR NameLength;
	USHORT NameOffset;
	USHORT Flags;               // 0x0001 = Compressed
	USHORT AttributeNumber;
} ATTRIBUTE, *PATTRIBUTE;

typedef struct {
	ATTRIBUTE Attribute;
	ULONGLONG LowVcn;
	ULONGLONG HighVcn;
	USHORT RunArrayOffset;
	UCHAR CompressionUnit;
	UCHAR AlignmentOrReserved[5];
	ULONGLONG AllocatedSize;
	ULONGLONG DataSize;
	ULONGLONG InitializedSize;
	ULONGLONG CompressedSize;    // Only when compressed
} NONRESIDENT_ATTRIBUTE, *PNONRESIDENT_ATTRIBUTE;

typedef struct {
	ATTRIBUTE Attribute;
	ULONG ValueLength;
	USHORT ValueOffset;
	USHORT Flags;               // 0x0001 = Indexed
} RESIDENT_ATTRIBUTE, *PRESIDENT_ATTRIBUTE;

typedef struct {
	ULONGLONG CreationTime;
	ULONGLONG ChangeTime;
	ULONGLONG LastWriteTime;
	ULONGLONG LastAccessTime;
	ULONG FileAttributes;
	ULONG AlignmentOrReservedOrUnknown[3];
	ULONG QuotaId;                        // NTFS 3.0 only
	ULONG SecurityId;                     // NTFS 3.0 only
	ULONGLONG QuotaCharge;                // NTFS 3.0 only
	USN Usn;                              // NTFS 3.0 only
} STANDARD_INFORMATION, *PSTANDARD_INFORMATION;

typedef struct {
	ULONGLONG DirectoryFileReferenceNumber;
	ULONGLONG CreationTime;   // Saved when filename last changed
	ULONGLONG ChangeTime;     // ditto
	ULONGLONG LastWriteTime;  // ditto
	ULONGLONG LastAccessTime; // ditto
	ULONGLONG AllocatedSize;  // ditto
	ULONGLONG DataSize;       // ditto
	ULONG FileAttributes;     // ditto
	ULONG AlignmentOrReserved;
	UCHAR NameLength;
	UCHAR NameType;           // 0x01 = Long, 0x02 = Short
	WCHAR Name[1];
} FILENAME_ATTRIBUTE, *PFILENAME_ATTRIBUTE;

HANDLE hVol = INVALID_HANDLE_VALUE;

bool EnumUsnRecord( const char* drvname, deque<MY_USN_RECORD>& con )
{
	bool ret = false;

	char FileSystemName[MAX_PATH+1];
	DWORD MaximumComponentLength;
	// 判断是否为 NTFS 格式
	if( GetVolumeInformationA( (string(drvname)+":\\").c_str(),0,0,0,&MaximumComponentLength,0,FileSystemName,MAX_PATH+1)
		&& 0==strcmp(FileSystemName,"NTFS") )
	{
		// 需要管理员权限，无奈
		hVol = CreateFileA( (string("\\\\.\\")+drvname+":").c_str() 
			, GENERIC_READ|GENERIC_WRITE, FILE_SHARE_READ|FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL);
		if( hVol != INVALID_HANDLE_VALUE )
		{
			DWORD br;
			USN_JOURNAL_DATA qujd;
			if( DeviceIoControl( hVol, FSCTL_QUERY_USN_JOURNAL, NULL, 0, &qujd, sizeof(qujd), &br, NULL ) )
			{
				char buffer[0x1000];
				DWORD BytesReturned;
				{
					READ_USN_JOURNAL_DATA rujd = { 0, -1, 0, 0, 0, qujd.UsnJournalID };
					for( ; DeviceIoControl(hVol,FSCTL_READ_USN_JOURNAL,&rujd,sizeof(rujd),buffer,_countof(buffer),&BytesReturned,NULL); rujd.StartUsn=*(USN*)&buffer )
					{
						DWORD dwRetBytes = BytesReturned - sizeof(USN);
						PUSN_RECORD UsnRecord = (PUSN_RECORD)((PCHAR)buffer+sizeof(USN));
						if( dwRetBytes==0 )
						{
							ret = true;
							break;
						}

						while( dwRetBytes > 0 )
						{
							MY_USN_RECORD myur = { UsnRecord->FileReferenceNumber, UsnRecord->ParentFileReferenceNumber, UsnRecord->TimeStamp, UsnRecord->Reason };
							memcpy( myur.FileName, UsnRecord->FileName, UsnRecord->FileNameLength );
							myur.FileName[UsnRecord->FileNameLength/2] = L'\0';

							con.push_back( myur );

							dwRetBytes -= UsnRecord->RecordLength;
							UsnRecord = (PUSN_RECORD)( (PCHAR)UsnRecord + UsnRecord->RecordLength );
						}
					}
				}
			}
			//CloseHandle( hVol );
		}
	}
	return ret;
}

 

 

例子二：

USNEyesApp.cpp

/**
* 对Ntfs下USN操作的示例程序
*/
#include <iostream>
#include <Windows.h>
#include <fstream>

using namespace std;

char* volName = "F:\\"; // 驱动盘名称

HANDLE hVol; // 用于储存驱动盘句柄

USN_JOURNAL_DATA UsnInfo; // 用于储存USN日志的基本信息

#define BUF_LEN 4096

ofstream fout("c:\\log.txt"); // 用来将数据记录到文本，方便查看

long counter = 0;

int main()
{
	BOOL status;
	BOOL isNTFS = false;
	BOOL getHandleSuccess = false;
	BOOL initUsnJournalSuccess = false;

	/**
	* step 01. 判断驱动盘是否NTFS格式
	* msdn:http://msdn.microsoft.com/en-us/library/aa364993%28VS.85%29.aspx
	*/
	cout<< "step 01. 判断驱动盘是否NTFS格式\n";
	char sysNameBuf[MAX_PATH] = {0};
	status = GetVolumeInformationA(volName,
		NULL, // 驱动盘名缓冲，这里我们不需要
		0,
		NULL,
		NULL,
		NULL,
		sysNameBuf, // 驱动盘的系统名（FAT/NTFS）
		MAX_PATH);

	if(0!=status){
		cout<< "文件系统名:" << sysNameBuf << "\n";
		// 比较字符串
		if(0==strcmp(sysNameBuf, "NTFS")){
			cout<< "此驱动盘是NTFS格式！转向step-02.\n";
			isNTFS = true;
		}else{
			cout<< "该驱动盘非NTFS格式\n";
		}

	}

	// 只有NTFS才有USN，才能进行操作
	if(isNTFS){
		/**
		* step 02. 获取驱动盘句柄
		* msdn:http://msdn.microsoft.com/en-us/library/aa363858%28VS.85%29.aspx
		*/
		cout<<"step 02. 获取驱动盘句柄\n";
		char fileName[MAX_PATH];
		fileName[0] = '\0';

		// 传入的文件名必须为\\.\C:的形式
		strcpy_s(fileName, "\\\\.\\");
		strcat_s(fileName, volName);
		// 为了方便操作，这里转为string进行去尾
		string fileNameStr = (string)fileName;
		fileNameStr.erase(fileNameStr.find_last_of(":")+1);

		cout<< "驱动盘地址:" << fileNameStr.data() << "\n";

		// 调用该函数需要管理员权限
		hVol = CreateFileA(fileNameStr.data(),
			GENERIC_READ | GENERIC_WRITE, // 可以为0
			FILE_SHARE_READ | FILE_SHARE_WRITE, // 必须包含有FILE_SHARE_WRITE
			NULL, // 这里不需要
			OPEN_EXISTING, // 必须包含OPEN_EXISTING, CREATE_ALWAYS可能会导致错误
			FILE_ATTRIBUTE_READONLY, // FILE_ATTRIBUTE_NORMAL可能会导致错误
			NULL); // 这里不需要

		if(INVALID_HANDLE_VALUE!=hVol){
			cout<< "获取驱动盘句柄成功！转向step-03.\n";
			getHandleSuccess = true;
		}else{
			cout<< "获取驱动盘句柄失败 —— handle:" << hVol << " error:" << GetLastError() << "\n";
		}
	}

	if(getHandleSuccess){
		/**
		* step 03. 初始化USN日志文件
		* msdn:http://msdn.microsoft.com/en-us/library/aa364558%28v=VS.85%29.aspx
		*/
		cout<< "step 03. 初始化USN日志文件\n";
		DWORD br;
		CREATE_USN_JOURNAL_DATA cujd;
		cujd.MaximumSize = 0; // 0表示使用默认值
		cujd.AllocationDelta = 0; // 0表示使用默认值
		status = DeviceIoControl(hVol,
			FSCTL_CREATE_USN_JOURNAL,
			&cujd,
			sizeof(cujd),
			NULL,
			0,
			&br,
			NULL);

		if(0!=status){
			cout<< "初始化USN日志文件成功！转向step-04.\n";
			initUsnJournalSuccess = true;
		}else{
			cout<< "初始化USN日志文件失败 —— status:" << status << " error:" << GetLastError() << "\n";
		}
	}

	if(initUsnJournalSuccess){

		BOOL getBasicInfoSuccess = false;

		/**
		* step 04. 获取USN日志基本信息(用于后续操作)
		* msdn:http://msdn.microsoft.com/en-us/library/aa364583%28v=VS.85%29.aspx
		*/
		cout<< "step 04. 获取USN日志基本信息(用于后续操作)\n";
		DWORD br;
		status = DeviceIoControl(hVol,
			FSCTL_QUERY_USN_JOURNAL,
			NULL,
			0,
			&UsnInfo,
			sizeof(USN_JOURNAL_DATA),
			&br,
			NULL);

		if(0!=status){
			cout<< "获取USN日志基本信息成功！转向step-05.\n";
			getBasicInfoSuccess = true;
		}else{
			cout<< "获取USN日志基本信息失败 —— status:" << status << " error:" << GetLastError() << "\n";
		}

		if(getBasicInfoSuccess){
			cout<< "UsnJournalID: " << UsnInfo.UsnJournalID << "\n";
			cout<< "lowUsn: " << UsnInfo.FirstUsn << "\n";
			cout<< "highUsn: " << UsnInfo.NextUsn << "\n";

			/**
			* step 05. 枚举USN日志文件中的所有记录
			* msdn:http://msdn.microsoft.com/en-us/library/aa364563%28v=VS.85%29.aspx
			*/
			cout<< "step 05. 枚举USN日志文件中的所有记录\n";
			MFT_ENUM_DATA med;
			med.StartFileReferenceNumber = 0;
			med.LowUsn = 0;//UsnInfo.FirstUsn; 这里经测试发现，如果用FirstUsn有时候不正确，导致获取到不完整的数据，还是直接写0好.
			med.HighUsn = UsnInfo.NextUsn;

			CHAR buffer[BUF_LEN]; // 用于储存记录的缓冲,尽量足够地大
			DWORD usnDataSize;
			PUSN_RECORD UsnRecord;

			while(0!=DeviceIoControl(hVol,
				FSCTL_ENUM_USN_DATA,
				&med,
				sizeof(med),
				buffer,
				BUF_LEN,
				&usnDataSize,
				NULL))
			{
				DWORD dwRetBytes = usnDataSize - sizeof(USN);

				// 找到第一个USN记录
				// from MSDN(http://msdn.microsoft.com/en-us/library/aa365736%28v=VS.85%29.aspx):
				// return a USN followed by zero or more change journal records, each in a USN_RECORD structure. 
				UsnRecord = (PUSN_RECORD)(((PCHAR)buffer)+sizeof(USN));
				cout<< " ********************************** \n";
				while(dwRetBytes>0){
					// 打印获取到的信息
					const int strLen = UsnRecord->FileNameLength;
					char fileName[MAX_PATH] = {0};
					//char filePath[MAX_PATH] = {0};
					WideCharToMultiByte(CP_OEMCP,NULL,UsnRecord->FileName,strLen/2,fileName,strLen,NULL,FALSE);

					cout<< "FileName: " << fileName << "\n";
					// 下面两个file reference number可以用来获取文件的路径信息
					cout<< "FileReferenceNumber: " << UsnRecord->FileReferenceNumber << "\n";
					cout<< "ParentFileReferenceNumber: " << UsnRecord->ParentFileReferenceNumber << "\n";
					//cout<< "FilePath: " << filePath << "\n\n";

					fout << "FileName:" << fileName << endl;
					fout << "FileReferenceNumber:" << UsnRecord->FileReferenceNumber << endl;
					fout << "ParentFileReferenceNumber:" << UsnRecord->ParentFileReferenceNumber << endl;
					//fout << "FilePath:" << filePath << endl;
					fout << endl;
					counter++;

					// 获取下一个记录
					DWORD recordLen = UsnRecord->RecordLength;
					dwRetBytes -= recordLen;
					UsnRecord = (PUSN_RECORD)(((PCHAR)UsnRecord)+recordLen);
				}

				//获取下一页数据，MTF大概是分多页来储存的吧？
				// from MSDN(http://msdn.microsoft.com/en-us/library/aa365736%28v=VS.85%29.aspx):
				// The USN returned as the first item in the output buffer is the USN of the next record number to be retrieved. 
				// Use this value to continue reading records from the end boundary forward.
				med.StartFileReferenceNumber = *(USN *)&buffer;

			}
			cout<< "共" << counter << "个文件\n";

			fout << "共" << counter << "个文件" << endl;
			fout << flush;
			fout.close();
		}

		/**
		* step 06. 删除USN日志文件(当然也可以不删除)
		* msdn:http://msdn.microsoft.com/en-us/library/aa364561%28v=VS.85%29.aspx
		*/
		cout<< "step 06. 删除USN日志文件(当然也可以不删除)\n";
		DELETE_USN_JOURNAL_DATA dujd;
		dujd.UsnJournalID = UsnInfo.UsnJournalID;
		dujd.DeleteFlags = USN_DELETE_FLAG_DELETE;

		status = DeviceIoControl(hVol,
			FSCTL_DELETE_USN_JOURNAL,
			&dujd,
			sizeof(dujd),
			NULL,
			0,
			&br,
			NULL);

		if(0 != status){
			cout<< "成功删除USN日志文件!\n";
		}else{
			cout<< "删除USN日志文件失败 —— status:" << status << " error:" << GetLastError() << "\n";
		}
	}

	// 最后释放一些资源
	if(getHandleSuccess){
		CloseHandle(hVol);
	}

	// 避免后台程序一闪而过
	MessageBox(0, L"按确定退出", L"结束", MB_OK);

	return 0;
}