c++ - 确定 NTFS 卷是否安装在外部

Question

我有一个软件可以使用卷过滤器驱动程序跟踪 Windows 操作系统上的 NTFS 卷更改。当在安装我的驱动程序的操作系统之外安装和修改卷时，我需要处理一个情况。

是否可以计算出卷的“最后安装时间”？或任何其他参数允许我判断该卷是否已在我的驱动程序控制之外安装？

Answer 1

我不知道“上次安装时间”，但有一个“日志文件打开计数”。如果你看http://www.opensource.apple.com/source/ntfs/ntfs-64/kext/ntfs_logfile.h ，你会看到一个像这样的 RESTART_AREA 结构:

/* 40*/ le32 restart_log_open_count;/* A counter that gets incremented every                                     time the logfile is restarted which happens                                     at mount time when the logfile is opened.                                     When creating set to a random value.  Win2k                                     sets it to the low 32 bits of the current                                     system time in NTFS format (see time.h). *//* 44*/ le32 reserved;      /* Reserved/alignment to 8-byte boundary. *//* sizeof() = 48 (0x30) bytes */} __attribute__((__packed__)) RESTART_AREA;

You can see that near the end of it is a restart_log_open_count that you can use to keep track of mounts. You would look at the value and compare it to a saved value. It should be equal to the saved value plus one. If so, it hasn't been mounted since you last had control.