Struct UsnJournal 

pub struct UsnJournal {
    handle: OwnedHandle,
    pub journal_id: u64,
    pub next_usn: i64,
}

An open USN journal positioned for tailing: the volume handle plus the current replay cursor.

Fields

handle: OwnedHandle

journal_id: u64

The journal’s identity (UsnJournalID); changes if NTFS recreates it, which invalidates any persisted checkpoint.

next_usn: i64

The next USN to read from; advances past each returned batch.

Implementations

impl UsnJournal

pub fn open(drive: &str, start_usn: Option<i64>) -> Result<Self, UsnError>

Open the journal for tailing. Creates it when missing (requires elevation, which the whole scan path already needs). start_usn is the persisted checkpoint; pass None to start at the current end.

Errors

Returns UsnError::OpenVolume if the volume handle cannot be opened, or UsnError::Fsctl if creating or querying the journal fails.

pub const fn checkpoint_valid( &self, persisted_journal_id: u64, data_first_usn: i64, ) -> bool

True if the persisted checkpoint is still replayable from this journal.

pub fn query(&self) -> Result<USN_JOURNAL_DATA_V0, UsnError>

Query the live journal metadata (id and retained USN range).

Errors

Returns UsnError::Fsctl if the FSCTL_QUERY_USN_JOURNAL call fails (including a journal that is no longer active).

fn query_or_create( handle: &OwnedHandle, ) -> Result<USN_JOURNAL_DATA_V0, UsnError>

fn query_raw(handle: &OwnedHandle) -> Result<USN_JOURNAL_DATA_V0, QueryErr>

pub fn read_blocking( &mut self, buf: &mut Vec<u8>, ) -> Result<ReadOutcome, UsnError>

Blocking read: returns once at least one record is available (or the journal became invalid). Advances next_usn past the returned batch.

Errors

Returns UsnError::Fsctl if the FSCTL_READ_USN_JOURNAL call fails for a reason other than a recoverable journal-gone condition (those are reported through ReadOutcome).