Versions in this module Expand all Collapse all v1 v1.0.8 Dec 18, 2023 v1.0.7 Dec 18, 2023 v1.0.6 Dec 18, 2023 Changes in this version type Journal + Handle *hsync.Handle v1.0.5 Dec 13, 2023 v1.0.4 Dec 13, 2023 v1.0.3 Dec 13, 2023 v1.0.2 Dec 13, 2023 v1.0.1 Nov 17, 2023 v1.0.0 Nov 17, 2023 Changes in this version + const DefaultPollingInterval + const Max + const MaxRecordSize + const Min + const MinimumPollingInterval + var ErrClosed = errors.New("monitor already closed") + var ErrFileNameExceedsBoundary = errors.New("USN record file name data exceeds the record boundary") + var ErrInsufficientBuffer = errors.New("unable to read record data due to insufficient buffer size") + var ErrInvalidWhence = errors.New("invalid whence value") + var ErrNegativeUSN = errors.New("the requested operation would result in a negative update sequence number") + var ErrNotFound = errors.New("not found") + var ErrRecordLengthExceedsMax = errors.New("USN record length exceeds maximum (possible data corruption)") + var ErrRecordLengthTooSmall = errors.New("USN record length is too small (possible data corruption)") + var ErrRecordLengthZero = errors.New("USN record length is zero (possible data corruption)") + var ErrRunning = errors.New("the monitor has already been started") + var ErrStopped = errors.New("the monitor has already been stopped") + var ErrTruncatedRecord = errors.New("USN record data was truncated") + var ReasonFormatBasic = ReasonFormat + var ReasonFormatConstant = ReasonFormat + var ReasonFormatShort = ReasonFormat + func CreateJournal(handle syscall.Handle, maxSize, allocDelta uint64) (err error) + func DeleteJournal(handle syscall.Handle) (err error) + func EnumData(handle syscall.Handle, opts RawEnumOptions, buffer []byte) (length uint32, err error) + func MarkHandle(handle syscall.Handle) (err error) + func ReadJournal(handle syscall.Handle, opts RawReadOptions, buffer []byte) (length uint32, err error) + type Cache struct + func NewCache() *Cache + func (c *Cache) Filer(frn fileref.ID) (record Record, err error) + func (c *Cache) Get(frn fileref.ID) (record Record, ok bool) + func (c *Cache) ReadFrom(ctx context.Context, iter Iter) error + func (c *Cache) Records() []Record + func (c *Cache) Set(r Record) + func (c *Cache) Size() int + type Cursor struct + func NewCursor(path string, reasonMask Reason, processor Processor, filter Filter, ...) (cursor *Cursor, err error) + func NewCursorWithHandle(handle *hsync.Handle, processor Processor, reasonMask Reason, filter Filter, ...) (*Cursor, error) + func (c *Cursor) Close() + func (c *Cursor) End(buffer []byte) + func (c *Cursor) Next(buffer []byte) (records []Record, err error) + func (c *Cursor) Read(p []byte) (n int, err error) + func (c *Cursor) Seek(offset int64, whence int) (usn int64, err error) + func (c *Cursor) Stats() (total, filtered Stats) + func (c *Cursor) USN() USN + type Enumerator struct + func NewEnumerator(path string, filter Filter, low, high USN) (enumerator *Enumerator, err error) + func NewEnumeratorWithHandle(handle *hsync.Handle, filter Filter, low, high USN) (*Enumerator, error) + func (e *Enumerator) Close() + func (e *Enumerator) Next(buffer []byte, data []Record) (records []Record, err error) + func (e *Enumerator) Read(p []byte) (n int, err error) + type Filer func(id fileref.ID) (Record, error) + func (f Filer) Parents(r Record) (records []Record, err error) + type Filter func(Record) bool + func (f Filter) Match(r Record) bool + type Iter interface + Next func(buffer []byte, data []Record) (records []Record, err error) + type Journal struct + func NewJournal(path string) (*Journal, error) + func NewJournalWithHandle(handle *hsync.Handle) *Journal + func (j *Journal) Cache(ctx context.Context, filter Filter, low, high USN) (*Cache, error) + func (j *Journal) Close() + func (j *Journal) Create(maxSize, allocDelta uint64) error + func (j *Journal) Cursor(processor Processor, reasonMask Reason, filter Filter, filer Filer) (*Cursor, error) + func (j *Journal) MFT() *MFT + func (j *Journal) Monitor() *Monitor + func (j *Journal) Query() (data RawJournalData, err error) + type MFT struct + func NewMFT(path string) (*MFT, error) + func NewMFTWithHandle(handle *hsync.Handle) *MFT + func (mft *MFT) Close() + func (mft *MFT) Enumerate(filter Filter, low, high USN) (*Enumerator, error) + func (mft *MFT) File(id fileref.ID) (record Record, err error) + type Monitor struct + func NewMonitor(path string) (monitor *Monitor, err error) + func NewMonitorWithHandle(handle *hsync.Handle) *Monitor + func (m *Monitor) Close() error + func (m *Monitor) Listen(chanSize int) <-chan Record + func (m *Monitor) Run(start USN, interval time.Duration, reasonMask Reason, processor Processor, ...) <-chan error + func (m *Monitor) Stop() error + func (m *Monitor) Unlisten(c <-chan Record) (found bool) + type Processor func(Record) + func (p Processor) Process(r Record) + type RawEnumOptions struct + High USN + Low USN + MaxMajorVersion uint16 + MinMajorVersion uint16 + StartFileReferenceNumber int64 + type RawJournalData struct + AllocationDelta uint64 + FirstUSN USN + Flags uint32 + JournalID uint64 + LowestValidUSN USN + MaxSupportedMajorVersion uint16 + MaxUSN USN + MaximumSize uint64 + MinSupportedMajorVersion uint16 + NextUSN USN + RangeTrackChunkSize uint64 + RangeTrackFileSizeThreshold int64 + func QueryJournal(handle syscall.Handle) (data RawJournalData, err error) + type RawReadOptions struct + BytesToWaitFor uint64 + JournalID uint64 + MaxMajorVersion uint16 + MinMajorVersion uint16 + ReasonMask Reason + ReturnOnlyOnClose uint32 + StartUSN USN + Timeout int64 + type RawRecordHeader struct + MajorVersion uint16 + MinorVersion uint16 + RecordLength uint32 + type RawRecordV1 struct + FileReferenceNumber int64 + ParentFileReferenceNumber int64 + TimeStamp windows.Filetime + USN USN + type RawRecordV2 struct + FileAttributes fileattr.Value + FileNameLength uint16 + FileNameOffset uint16 + FileReferenceNumber int64 + ParentFileReferenceNumber int64 + Reason Reason + SecurityID uint32 + SourceInfo usnsource.Info + TimeStamp windows.Filetime + USN USN + type RawRecordV3 struct + FileAttributes fileattr.Value + FileNameLength uint16 + FileNameOffset uint16 + FileReferenceNumber [16]byte + ParentFileReferenceNumber [16]byte + Reason Reason + SecurityID uint32 + SourceInfo usnsource.Info + TimeStamp windows.Filetime + USN USN + type RawRecordV4 struct + ExtentSize uint16 + FileReferenceNumber [16]byte + NumberOfExtents uint16 + ParentFileReferenceNumber [16]byte + Reason Reason + RemainingExtents uint32 + SourceInfo usnsource.Info + USN USN + type Reason uint32 + const ReasonAny + const ReasonBasicInfoChange + const ReasonClose + const ReasonCompressionChange + const ReasonDataExtend + const ReasonDataOverwrite + const ReasonDataTruncation + const ReasonEAChange + const ReasonEncryptionChange + const ReasonFileCreate + const ReasonFileDelete + const ReasonHardLinkChange + const ReasonIndexableChange + const ReasonIntegrityChange + const ReasonNamedDataExtend + const ReasonNamedDataOverwrite + const ReasonNamedDataTruncation + const ReasonObjectIDChange + const ReasonRename + const ReasonRenameNewName + const ReasonRenameOldName + const ReasonReparsePointChange + const ReasonSecurityChange + const ReasonStreamChange + const ReasonTransactedChange + func ParseReason(reason string) (code Reason, err error) + func (r Reason) Join(sep string, format ReasonFormat) string + func (r Reason) Match(c Reason) bool + func (r Reason) Rename() bool + func (r Reason) String() string + type ReasonFormat map[Reason]string + type Record struct + FileAttributes fileattr.Value + FileName string + FileReferenceNumber fileref.ID + MajorVersion uint16 + MinorVersion uint16 + ParentFileReferenceNumber fileref.ID + Path string + Reason Reason + RecordLength uint32 + SecurityID uint32 + SourceInfo usnsource.Info + TimeStamp time.Time + USN USN + func (r *Record) UnmarshalBinary(data []byte) error + type RecordExtent struct + Length int64 + Offset int64 + type Stats struct + Bytes uint64 + First time.Time + Last time.Time + Records uint64 + func (s *Stats) Add(r *Record) + type USN int64