问题描述
在Windows 10客户端范围内，在NTFS卷E：上启用了跟踪。从查询（DeviceIoControl（FSCTL_QUERY_USN_JOURNAL）），RangeTrackngChunkSize为16KB，RangeTrackFileSizeThreshold为1MB。 但是对于大于2MB的文件，如果前两个字节
和最后2个字节在文件关闭之前被修改，我相信这将有两个范围。但是只有一个范围，大文件中的任何更改都被视为从偏移0开始的单个更改，w /文件大小作为范围长度。这是
不正确。有关详细信息，请参阅下面的日志（来自我自己的程序）。
On a Windows 10 client range tracking is enabled on NTFS volume E:. From the query (DeviceIoControl(FSCTL_QUERY_USN_JOURNAL)), RangeTrackngChunkSize is 16KB, and RangeTrackFileSizeThreshold is 1MB. But for a file larger than 2MB if the first 2 bytes and the last 2 bytes are modified before the file close, I believe this will have two extents. But there is only one extent, any change inside the large file is considered as a single change starting from offset 0, w/ file size as the extent length. This is NOT correct. See below logs (from my own program) for details.
//从下面开始记录...
// Log starts below...
此日志启用了范围跟踪USN 760
期刊信息...
MinSupportedMajorVersion = 2
MaxSupportedMajorVersion = 4
RangeTrackChunkSize = 16384
RangeTrackFileSizeThreshold = 1048576
FirstUsn：0
NextUsn：8992
====== USN记录V3 ======
USN：8672
文件名：large.txt
原因：4
====== USN记录V3 ======
USN：8752
文件名：large.txt
原因：6
====== USN记录V4 == ====
USN：8832
原因：80000006
剩余时间：0左右
NumberOfExtents：1
ExtentSize：16
范围1：抵消：0，长度：2129920
====== USN记录V3 ======
USN：8912
文件名：large.txt
原因：80000006
P任何关键都要继续..
Range tracking is enabled on this journal since USN 760
Journal Info...
MinSupportedMajorVersion=2
MaxSupportedMajorVersion=4
RangeTrackChunkSize=16384
RangeTrackFileSizeThreshold=1048576
FirstUsn: 0
NextUsn: 8992
======USN Record V3======
USN: 8672
File name: large.txt
Reason: 4
======USN Record V3======
USN: 8752
File name: large.txt
Reason: 6
======USN Record V4======
USN: 8832
Reason: 80000006
RemainingExtents: 0
NumberOfExtents: 1
ExtentSize: 16
Extent 1: Offset: 0, Length: 2129920
======USN Record V3======
USN: 8912
File name: large.txt
Reason: 80000006
Press any key to continue..
谢谢，
Jing
Thanks,
Jing
推荐答案
- pa
这篇关于NTFS范围跟踪是否有效？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！