<em>Mac</em>Book项目 2009年学校开始实施<em>Mac</em>Book项目,所有师生配备一本<em>Mac</em>Book,并同步更新了校园无线网络。学校每周进行电脑技术更新,每月发送技术支持资料,极大改变了教学及学习方式。因此2011
2021-06-01 09:32:01
相信使用過Everything的人都對其超快的搜尋速度印象非常深刻,它的主要原理是通過掃描NTFS磁碟的USN Journal讀取的檔案列表,而不是磁碟目錄,由於USN Journal非常小,因此能實現快速搜尋。
由於.Net程式的Dll基本上是通用的,在C#中也可以直接使用它。
public class MFTScanner { private static IntPtr INVALID_HANDLE_VALUE = new IntPtr(-1); private const uint GENERIC_READ = 0x80000000; private const int FILE_SHARE_READ = 0x1; private const int FILE_SHARE_WRITE = 0x2; private const int OPEN_EXISTING = 3; private const int FILE_READ_ATTRIBUTES = 0x80; private const int FILE_NAME_IINFORMATION = 9; private const int FILE_FLAG_BACKUP_SEMANTICS = 0x2000000; private const int FILE_OPEN_FOR_BACKUP_INTENT = 0x4000; private const int FILE_OPEN_BY_FILE_ID = 0x2000; private const int FILE_OPEN = 0x1; private const int OBJ_CASE_INSENSITIVE = 0x40; private const int FSCTL_ENUM_USN_DATA = 0x900b3; [StructLayout(LayoutKind.Sequential)] private struct MFT_ENUM_DATA { public long StartFileReferenceNumber; public long LowUsn; public long HighUsn; } [StructLayout(LayoutKind.Sequential)] private struct USN_RECORD { public int RecordLength; public short MajorVersion; public short MinorVersion; public long FileReferenceNumber; public long ParentFileReferenceNumber; public long Usn; public long TimeStamp; public int Reason; public int SourceInfo; public int SecurityId; public FileAttributes FileAttributes; public short FileNameLength; public short FileNameOffset; } [StructLayout(LayoutKind.Sequential)] private struct IO_STATUS_BLOCK { public int Status; public int Information; } [StructLayout(LayoutKind.Sequential)] private struct UNICODE_STRING { public short Length; public short MaximumLength; public IntPtr Buffer; } [StructLayout(LayoutKind.Sequential)] private struct OBJECT_ATTRIBUTES { public int Length; public IntPtr RootDirectory; public IntPtr ObjectName; public int Attributes; public int SecurityDescriptor; public int SecurityQualityOfService; } //// MFT_ENUM_DATA [DllImport("kernel32.dll", ExactSpelling = true, SetLastError = true, CharSet = CharSet.Auto)] private static extern bool DeviceIoControl(IntPtr hDevice, int dwIoControlCode, ref MFT_ENUM_DATA lpInBuffer, int nInBufferSize, IntPtr lpOutBuffer, int nOutBufferSize, ref int lpBytesReturned, IntPtr lpOverlapped); [DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Auto)] private static extern IntPtr CreateFile(string lpFileName, uint dwDesiredAccess, int dwShareMode, IntPtr lpSecurityAttributes, int dwCreationDisposition, int dwFlagsAndAttributes, IntPtr hTemplateFile); [DllImport("kernel32.dll", ExactSpelling = true, SetLastError = true, CharSet = CharSet.Auto)] private static extern Int32 CloseHandle(IntPtr lpObject); [DllImport("ntdll.dll", ExactSpelling = true, SetLastError = true, CharSet = CharSet.Auto)] private static extern int NtCreateFile(ref IntPtr FileHandle, int DesiredAccess, ref OBJECT_ATTRIBUTES ObjectAttributes, ref IO_STATUS_BLOCK IoStatusBlock, int AllocationSize, int FileAttribs, int SharedAccess, int CreationDisposition, int CreateOptions, int EaBuffer, int EaLength); [DllImport("ntdll.dll", ExactSpelling = true, SetLastError = true, CharSet = CharSet.Auto)] private static extern int NtQueryInformationFile(IntPtr FileHandle, ref IO_STATUS_BLOCK IoStatusBlock, IntPtr FileInformation, int Length, int FileInformationClass); private IntPtr m_hCJ; private IntPtr m_Buffer; private int m_BufferSize; private string m_DriveLetter; private class FSNode { public long FRN; public long ParentFRN; public string FileName; public bool IsFile; public FSNode(long lFRN, long lParentFSN, string sFileName, bool bIsFile) { FRN = lFRN; ParentFRN = lParentFSN; FileName = sFileName; IsFile = bIsFile; } } private IntPtr OpenVolume(string szDriveLetter) { IntPtr hCJ = default(IntPtr); //// volume handle m_DriveLetter = szDriveLetter; hCJ = CreateFile(@"\." + szDriveLetter, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE, IntPtr.Zero, OPEN_EXISTING, 0, IntPtr.Zero); return hCJ; } private void Cleanup() { if (m_hCJ != IntPtr.Zero) { // Close the volume handle. CloseHandle(m_hCJ); m_hCJ = INVALID_HANDLE_VALUE; } if (m_Buffer != IntPtr.Zero) { // Free the allocated memory Marshal.FreeHGlobal(m_Buffer); m_Buffer = IntPtr.Zero; } } public IEnumerable<String> EnumerateFiles(string szDriveLetter) { try { var usnRecord = default(USN_RECORD); var mft = default(MFT_ENUM_DATA); var dwRetBytes = 0; var cb = 0; var dicFRNLookup = new Dictionary<long, FSNode>(); var bIsFile = false; // This shouldn't be called more than once. if (m_Buffer.ToInt32() != 0) { throw new Exception("invalid buffer"); } // Assign buffer size m_BufferSize = 65536; //64KB // Allocate a buffer to use for reading records. m_Buffer = Marshal.AllocHGlobal(m_BufferSize); // correct path szDriveLetter = szDriveLetter.TrimEnd('\'); // Open the volume handle m_hCJ = OpenVolume(szDriveLetter); // Check if the volume handle is valid. if (m_hCJ == INVALID_HANDLE_VALUE) { string errorMsg = "Couldn't open handle to the volume."; if (!IsAdministrator()) errorMsg += "Current user is not administrator"; throw new Exception(errorMsg); } mft.StartFileReferenceNumber = 0; mft.LowUsn = 0; mft.HighUsn = long.MaxValue; do { if (DeviceIoControl(m_hCJ, FSCTL_ENUM_USN_DATA, ref mft, Marshal.SizeOf(mft), m_Buffer, m_BufferSize, ref dwRetBytes, IntPtr.Zero)) { cb = dwRetBytes; // Pointer to the first record IntPtr pUsnRecord = new IntPtr(m_Buffer.ToInt32() + 8); while ((dwRetBytes > 8)) { // Copy pointer to USN_RECORD structure. usnRecord = (USN_RECORD)Marshal.PtrToStructure(pUsnRecord, usnRecord.GetType()); // The filename within the USN_RECORD. string FileName = Marshal.PtrToStringUni(new IntPtr(pUsnRecord.ToInt32() + usnRecord.FileNameOffset), usnRecord.FileNameLength / 2); bIsFile = !usnRecord.FileAttributes.HasFlag(FileAttributes.Directory); dicFRNLookup.Add(usnRecord.FileReferenceNumber, new FSNode(usnRecord.FileReferenceNumber, usnRecord.ParentFileReferenceNumber, FileName, bIsFile)); // Pointer to the next record in the buffer. pUsnRecord = new IntPtr(pUsnRecord.ToInt32() + usnRecord.RecordLength); dwRetBytes -= usnRecord.RecordLength; } // The first 8 bytes is always the start of the next USN. mft.StartFileReferenceNumber = Marshal.ReadInt64(m_Buffer, 0); } else { break; // TODO: might not be correct. Was : Exit Do } } while (!(cb <= 8)); // Resolve all paths for Files foreach (FSNode oFSNode in dicFRNLookup.Values.Where(o => o.IsFile)) { string sFullPath = oFSNode.FileName; FSNode oParentFSNode = oFSNode; while (dicFRNLookup.TryGetValue(oParentFSNode.ParentFRN, out oParentFSNode)) { sFullPath = string.Concat(oParentFSNode.FileName, @"", sFullPath); } sFullPath = string.Concat(szDriveLetter, @"", sFullPath); yield return sFullPath; } } finally { //// cleanup Cleanup(); } } public static bool IsAdministrator() { WindowsIdentity identity = WindowsIdentity.GetCurrent(); WindowsPrincipal principal = new WindowsPrincipal(identity); return principal.IsInRole(WindowsBuiltInRole.Administrator); } }
本文還提供了一個擴充套件方法,方便我們獲取某個磁碟下的所有的檔名。
public static class DriveInfoExtension { public static IEnumerable<String> EnumerateFiles(this DriveInfo drive) { return (new MFTScanner()).EnumerateFiles(drive.Name); } }
需要注意的是,讀取USN Journal是需要管理員許可權的,因此使用這個類需要管理員許可權才能正常執行。
另外,這個類封裝的也略為簡單,唯讀取了檔名,實際上還可以讀取檔案大小,屬性等常用資訊,修改一下程式碼非常容易獲取這些屬性。通過它們可以非常方便寫出一些分析磁碟空間佔用的程式,這裡就不舉例了。
到此這篇關於C#實現快速查詢檔案的文章就介紹到這了。希望對大家的學習有所幫助,也希望大家多多支援it145.com。
相關文章
<em>Mac</em>Book项目 2009年学校开始实施<em>Mac</em>Book项目,所有师生配备一本<em>Mac</em>Book,并同步更新了校园无线网络。学校每周进行电脑技术更新,每月发送技术支持资料,极大改变了教学及学习方式。因此2011
2021-06-01 09:32:01
综合看Anker超能充系列的性价比很高,并且与不仅和iPhone12/苹果<em>Mac</em>Book很配,而且适合多设备充电需求的日常使用或差旅场景,不管是安卓还是Switch同样也能用得上它,希望这次分享能给准备购入充电器的小伙伴们有所
2021-06-01 09:31:42
除了L4WUDU与吴亦凡已经多次共事,成为了明面上的厂牌成员,吴亦凡还曾带领20XXCLUB全队参加2020年的一场音乐节,这也是20XXCLUB首次全员合照,王嗣尧Turbo、陈彦希Regi、<em>Mac</em> Ova Seas、林渝植等人全部出场。然而让
2021-06-01 09:31:34
目前应用IPFS的机构:1 谷歌<em>浏览器</em>支持IPFS分布式协议 2 万维网 (历史档案博物馆)数据库 3 火狐<em>浏览器</em>支持 IPFS分布式协议 4 EOS 等数字货币数据存储 5 美国国会图书馆,历史资料永久保存在 IPFS 6 加
2021-06-01 09:31:24
开拓者的车机是兼容苹果和<em>安卓</em>,虽然我不怎么用,但确实兼顾了我家人的很多需求:副驾的门板还配有解锁开关,有的时候老婆开车,下车的时候偶尔会忘记解锁,我在副驾驶可以自己开门:第二排设计很好,不仅配置了一个很大的
2021-06-01 09:30:48
不仅是<em>安卓</em>手机,苹果手机的降价力度也是前所未有了,iPhone12也“跳水价”了,发布价是6799元,如今已经跌至5308元,降价幅度超过1400元,最新定价确认了。iPhone12是苹果首款5G手机,同时也是全球首款5nm芯片的智能机,它
2021-06-01 09:30:45