Is NTFS range tracking ever working? RRS feed

  • Question

  • Hi,

    On a Windows 10 client range tracking is enabled on NTFS volume E:. From the query (DeviceIoControl(FSCTL_QUERY_USN_JOURNAL)), RangeTrackngChunkSize is 16KB, and RangeTrackFileSizeThreshold is 1MB.  But for a file larger than 2MB if the first 2 bytes and the last 2 bytes are modified before the file close, I believe this will have two extents. But there is only one extent, any change inside the large file is considered as a single change starting from offset 0, w/ file size as the extent length. This is NOT correct. See below logs (from my own program) for details.

    // Log starts below...

    Range tracking is enabled on this journal since USN 760

    Journal Info...
    FirstUsn: 0
    NextUsn: 8992

    ======USN Record V3======
    USN: 8672
    File name: large.txt
    Reason: 4

    ======USN Record V3======
    USN: 8752
    File name: large.txt
    Reason: 6

    ======USN Record V4======
    USN: 8832
    Reason: 80000006
    RemainingExtents: 0
    NumberOfExtents: 1
    ExtentSize: 16
    Extent 1: Offset: 0, Length: 2129920

    ======USN Record V3======
    USN: 8912
    File name: large.txt
    Reason: 80000006

    Press any key to continue..


    • Edited by Eric Zhao1 Thursday, October 11, 2018 9:57 AM
    • Moved by Baron Bi Thursday, November 8, 2018 8:32 AM
    Thursday, October 11, 2018 9:46 AM

All replies