相信很多人都有玩過Everything這套搜尋軟體，也對他的快速搜尋印象深刻。其實它之所以快速是因為它很聰明的去掃了NTFS的USN Journal，它的資料量會比我們去遍巡檔案系統還要少的多，所以可以在很短的時間完成檔案的索引，自然運行起來就會很快速。
那麼我們要怎樣在.NET程式中實現類似的效果呢？筆者暫時還不想長篇大論的跟大家解釋如何讀取USN Journal，所以這邊筆者是用MFT Scanner in VB.NET來做到類似的效果。檔案下載下來後可以看到裡面只有ㄧ個專案，運行起來就是ㄧ個簡單的搜尋程式，上方的輸入框是輸入要找尋的檔案位置，而下方的輸入框是讓我們指定找到的檔案清單要寫到哪個目錄下，輸入完後按下Start Processing按鈕就會開始進行MFT的搜尋與ㄧ般遞迴的搜尋，搜尋結束下方會顯示出搜尋的結果。
若要將這功能套用到自己的專案中，我們可以將他專案中的cEnumMFT.vb檔加入到自己的專案，並建立出cEnumMFT的物件實體，最後再透過建立出來的物件實體去叫用FindAllFiles就可以了。叫用時必需要帶入要搜尋的磁碟槽以及ㄧ個委派去負責處裡找到的檔案，最後兩個參數個人覺得意義不大，所以直接傳入Nothing就可以了。像是下面這樣： Dim scanner = New cEnumMFT scanner.FindAllFiles(“c:", Sub(file, size) End Sub, Nothing, Nothing)
筆者也花了點時間將之轉成C#了，並做了些調整，有需要的可以直接取用。
using System; using System.Collections.Generic; using System.Linq; using System.Text; using System.Runtime.InteropServices; using Microsoft.VisualBasic;
public class MFTScanner { private static IntPtr INVALID_HANDLE_VALUE = new IntPtr(-1); private const uint GENERIC_READ = 0x80000000; private const int FILE_SHARE_READ = 0x1; private const int FILE_SHARE_WRITE = 0x2; private const int OPEN_EXISTING = 3; private const int FILE_READ_ATTRIBUTES = 0x80; private const int FILE_NAME_IINFORMATION = 9; private const int FILE_FLAG_BACKUP_SEMANTICS = 0x2000000; private const int FILE_OPEN_FOR_BACKUP_INTENT = 0x4000; private const int FILE_OPEN_BY_FILE_ private const int FILE_OPEN = 0x1; private const int OBJ_CASE_INSENSITIVE = 0x40; private const int FSCTL_ENUM_USN_DATA = 0x900b3;
[StructLayout(LayoutKind.Sequential)] private struct MFT_ENUM_DATA { public long StartFileReferenceNumber; public long LowUsn; public long HighUsn; }
[StructLayout(LayoutKind.Sequential)] private struct USN_RECORD { public int RecordLength; public short MajorVersion; public short MinorVersion; public long FileReferenceNumber; public long ParentFileReferenceNumber; public long Usn; public long TimeStamp; public int Reason; public int SourceInfo; public int SecurityId; public FileAttribute FileAttributes; public short FileNameLength; public short FileNameOffset; }
[StructLayout(LayoutKind.Sequential)] private struct IO_STATUS_BLOCK { public int Status; public int Information; }
[StructLayout(LayoutKind.Sequential)] private struct UNICODE_STRING { public short Length; public short MaximumLength; public IntPtr Buffer; }
[StructLayout(LayoutKind.Sequential)] private struct OBJECT_ATTRIBUTES { public int Length; public IntPtr RootDirectory; public IntPtr ObjectName; public int Attributes; public int SecurityDescriptor; public int SecurityQualityOfService; }
//// MFT_ENUM_DATA [DllImport(“kernel32.dll”, ExactSpelling = true, SetLastError = true, CharSet = CharSet.Auto)] private static extern bool DeviceIoControl(IntPtr hDevice, int dwIoControlCode, ref MFT_ENUM_DATA lpInBuffer, int nInBufferSize, IntPtr lpOutBuffer, int nOutBufferSize, ref int lpBytesReturned, IntPtr lpOverlapped);
[DllImport(“kernel32.dll”, SetLastError = true, CharSet = CharSet.Auto)] private static extern IntPtr CreateFile(string lpFileName, uint dwDesiredAccess, int dwShareMode, IntPtr lpSecurityAttributes, int dwCreationDisposition, int dwFlagsAndAttributes, IntPtr hTemplateFile);
[DllImport(“kernel32.dll”, ExactSpelling = true, SetLastError = true, CharSet = CharSet.Auto)] private static extern Int32 CloseHandle(IntPtr lpObject);
[DllImport(“ntdll.dll”, ExactSpelling = true, SetLastError = true, CharSet = CharSet.Auto)] private static extern int NtCreateFile(ref IntPtr FileHandle, int DesiredAccess, ref OBJECT_ATTRIBUTES ObjectAttributes, ref IO_STATUS_BLOCK IoStatusBlock, int AllocationSize, int FileAttribs, int SharedAccess, int CreationDisposition, int CreateOptions, int EaBuffer, int EaLength);
[DllImport(“ntdll.dll”, ExactSpelling = true, SetLastError = true, CharSet = CharSet.Auto)] private static extern int NtQueryInformationFile(IntPtr FileHandle, ref IO_STATUS_BLOCK IoStatusBlock, IntPtr FileInformation, int Length, int FileInformationClass);
private IntPtr m_hCJ; private IntPtr m_Buffer; private int m_BufferSize;
private string m_DriveLetter;
private class FSNode { public long FRN; public long ParentFRN; public string FileName;
public bool IsFile; public FSNode(long lFRN, long lParentFSN, string sFileName, bool bIsFile) { FRN = lFRN; ParentFRN = lParentFSN; File IsFile = bIsFile; }
}
private IntPtr OpenVolume(string szDriveLetter) {
IntPtr hCJ = default(IntPtr); //// volume handle
m_DriveLetter = szDriveLetter;
hCJ = CreateFile(”\." + szDriveLetter, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE, IntPtr.Zero, OPEN_EXISTING, 0, IntPtr.Zero);
return hCJ;
}
private void Cleanup() { if (m_hCJ != IntPtr.Zero) { // Close the volume handle. CloseHandle(m_hCJ); m_hCJ = INVALID_HANDLE_VALUE; }
if (m_Buffer != IntPtr.Zero) { // Free the allocated memory Marshal.FreeHGlobal(m_Buffer); m_Buffer = IntPtr.Zero; }
}
public IEnumerable EnumerateFiles(string szDriveLetter) { try { var usnRecord = default(USN_RECORD); var mft = default(MFT_ENUM_DATA); var dwRetBytes = 0; var cb = 0; var dicFRNLookup = new Dictionary(); var bIsFile = false;
// This shouldn’t be called more than once. if (m_Buffer.ToInt32() != 0) { throw new Exception(“invalid buffer”); }
// Assign buffer size m_Buffer //64KB
// Allocate a buffer to use for reading records. m_Buffer = Marshal.AllocHGlobal(m_BufferSize);
// correct path szDriveLetter = szDriveLetter.TrimEnd(’');
// Open the volume handle m_hCJ = OpenVolume(szDriveLetter);
// Check if the volume handle is valid. if (m_hCJ == INVALID_HANDLE_VALUE) { throw new Exception(“Couldn’t open handle to the volume.”); }
mft.StartFileReferenceNumber = 0; mft.LowUsn = 0; mft.HighUsn = long.MaxValue;
do { if (DeviceIoControl(m_hCJ, FSCTL_ENUM_USN_DATA, ref mft, Marshal.SizeOf(mft), m_Buffer, m_BufferSize, ref dwRetBytes, IntPtr.Zero)) { cb = dwRetBytes; // Pointer to the first record IntPtr pUsnRecord = new IntPtr(m_Buffer.ToInt32() + 8);
while ((dwRetBytes > 8)) { // Copy pointer to USN_RECORD structure. usnRecord = (USN_RECORD)Marshal.PtrToStructure(pUsnRecord, usnRecord.GetType());
// The filename within the USN_RECORD. string File IntPtr(pUsnRecord.ToInt32() + usnRecord.FileNameOffset), usnRecord.FileNameLength / 2);
bIsFile = !usnRecord.FileAttributes.HasFlag(FileAttribute.Directory); dicFRNLookup.Add(usnRecord.FileReferenceNumber, new FSNode(usnRecord.FileReferenceNumber, usnRecord.ParentFileReferenceNumber, FileName, bIsFile));
// Pointer to the next record in the buffer. pUsnRecord = new IntPtr(pUsnRecord.ToInt32() + usnRecord.RecordLength);
dwRetBytes -= usnRecord.RecordLength; }
// The first 8 bytes is always the start of the next USN. mft.StartFileReferenceNumber = Marshal.ReadInt64(m_Buffer, 0);
} else { break; // TODO: might not be correct. Was : Exit Do
}
} while (!(cb o.IsFile)) { string sFullPath = oFSNode.FileName; FSNode oParentFSNode = oFSNode;
while (dicFRNLookup.TryGetValue(oParentFSNode.ParentFRN, out oParentFSNode)) { sFullPath = string.Concat(oParentFSNode.FileName, “", sFullPath); } sFullPath = string.Concat(szDriveLetter, “", sFullPath);
yield return sFullPath; } } finally { //// cleanup Cleanup(); } } }
因為USN Journal是綁磁碟的，所以筆者也將之整理成DriveInfo的擴充方法，使用上會比較方便些。
using System; using System.Collections.Generic; using System.Linq; using System.Text; using System.IO;
public static class DriveInfoExtension { public static IEnumerable EnumerateFiles(this DriveInfo drive) { return (new MFTScanner()).EnumerateFiles(drive.Name); } }
使用起來會像下面這樣：
using System; using System.Collections.Generic; using System.Linq; using System.Text; using System.IO; using System.Diagnostics;
namespace ConsoleApplication28 { class Program { static void Main(string[] args) { var sw = Stopwatch.StartNew(); var files = (new DriveInfo(@“c:")).EnumerateFiles().ToArray(); var elapsed = sw.ElapsedMilliseconds.ToString(); Console.WriteLine(string.Format(“Found {0} files, elapsed {1} ms”, files.Length, elapsed)); } } }
運行後我們可以看到，程式找尋筆者的磁碟C，找到501230個檔案也才花了7344ms。
Link
MFT Scanner in VB.NET