在C#中快速查询文件

相信使用过Everything的人都对其超快的搜索速度印象非常深刻，它的主要原理是通过扫描NTFS磁盘的USN Journal读取的文件列表，而不是磁盘目录，由于USN Journal非常小，因此能实现快速搜索。在CodePlex上也有人对这个功能进行了.Net的封装：MFT Scanner in VB.NET。

由于.Net程序的Dll基本上是通用的，在C#中也可以直接使用它。今天发现了有人将其翻译成了C#的版本《使用MFT Scanner遍巡USN Journal，快速找出磁碟內的所有檔案》，使用起来更为方便了。不过，原文貌似有点Bug，编译不过去，这里我改了一下，附录如下：

     public class MFTScanner
     {
         private static IntPtr INVALID_HANDLE_VALUE = new IntPtr(-);
         private const uint GENERIC_READ = 0x80000000;
         private const int FILE_SHARE_READ = 0x1;
         private const int FILE_SHARE_WRITE = 0x2;
         private const int OPEN_EXISTING = ;
         private const int FILE_READ_ATTRIBUTES = 0x80;
         private const int FILE_NAME_IINFORMATION = ;
         private const int FILE_FLAG_BACKUP_SEMANTICS = 0x2000000;
         private const int FILE_OPEN_FOR_BACKUP_INTENT = 0x4000;
         private const int FILE_OPEN_BY_FILE_ID = 0x2000;
         private const int FILE_OPEN = 0x1;
         private const int OBJ_CASE_INSENSITIVE = 0x40;
         private const int FSCTL_ENUM_USN_DATA = 0x900b3;

         [StructLayout(LayoutKind.Sequential)]
         private struct MFT_ENUM_DATA
         {
             public long StartFileReferenceNumber;
             public long LowUsn;
             public long HighUsn;
         }

         [StructLayout(LayoutKind.Sequential)]
         private struct USN_RECORD
         {
             public int RecordLength;
             public short MajorVersion;
             public short MinorVersion;
             public long FileReferenceNumber;
             public long ParentFileReferenceNumber;
             public long Usn;
             public long TimeStamp;
             public int Reason;
             public int SourceInfo;
             public int SecurityId;
             public FileAttributes FileAttributes;
             public short FileNameLength;
             public short FileNameOffset;
         }

         [StructLayout(LayoutKind.Sequential)]
         private struct IO_STATUS_BLOCK
         {
             public int Status;
             public int Information;
         }

         [StructLayout(LayoutKind.Sequential)]
         private struct UNICODE_STRING
         {
             public short Length;
             public short MaximumLength;
             public IntPtr Buffer;
         }

         [StructLayout(LayoutKind.Sequential)]
         private struct OBJECT_ATTRIBUTES
         {
             public int Length;
             public IntPtr RootDirectory;
             public IntPtr ObjectName;
             public int Attributes;
             public int SecurityDescriptor;
             public int SecurityQualityOfService;
         }

         //// MFT_ENUM_DATA
         [DllImport("kernel32.dll", ExactSpelling = true, SetLastError = true, CharSet = CharSet.Auto)]
         private static extern bool DeviceIoControl(IntPtr hDevice, int dwIoControlCode, ref MFT_ENUM_DATA lpInBuffer, int nInBufferSize, IntPtr lpOutBuffer, int nOutBufferSize, ref int lpBytesReturned, IntPtr lpOverlapped);

         [DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Auto)]
         private static extern IntPtr CreateFile(string lpFileName, uint dwDesiredAccess, int dwShareMode, IntPtr lpSecurityAttributes, int dwCreationDisposition, int dwFlagsAndAttributes, IntPtr hTemplateFile);

         [DllImport("kernel32.dll", ExactSpelling = true, SetLastError = true, CharSet = CharSet.Auto)]
         private static extern Int32 CloseHandle(IntPtr lpObject);

         [DllImport("ntdll.dll", ExactSpelling = true, SetLastError = true, CharSet = CharSet.Auto)]
         private static extern int NtCreateFile(ref IntPtr FileHandle, int DesiredAccess, ref OBJECT_ATTRIBUTES ObjectAttributes, ref IO_STATUS_BLOCK IoStatusBlock, int AllocationSize, int FileAttribs, int SharedAccess, int CreationDisposition, int CreateOptions, int EaBuffer,
         int EaLength);

         [DllImport("ntdll.dll", ExactSpelling = true, SetLastError = true, CharSet = CharSet.Auto)]
         private static extern int NtQueryInformationFile(IntPtr FileHandle, ref IO_STATUS_BLOCK IoStatusBlock, IntPtr FileInformation, int Length, int FileInformationClass);

         private IntPtr m_hCJ;
         private IntPtr m_Buffer;
         private int m_BufferSize;

         private string m_DriveLetter;

         private class FSNode
         {
             public long FRN;
             public long ParentFRN;
             public string FileName;

             public bool IsFile;
             public FSNode(long lFRN, long lParentFSN, string sFileName, bool bIsFile)
             {
                 FRN = lFRN;
                 ParentFRN = lParentFSN;
                 FileName = sFileName;
                 IsFile = bIsFile;
             }
         }

         private IntPtr OpenVolume(string szDriveLetter)
         {

             IntPtr hCJ = default(IntPtr);
             //// volume handle

             m_DriveLetter = szDriveLetter;
             hCJ = CreateFile(@"\\.\" + szDriveLetter, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE, IntPtr.Zero, OPEN_EXISTING, , IntPtr.Zero);

             return hCJ;

         }

         private void Cleanup()
         {
             if (m_hCJ != IntPtr.Zero)
             {
                 // Close the volume handle.
                 CloseHandle(m_hCJ);
                 m_hCJ = INVALID_HANDLE_VALUE;
             }

             if (m_Buffer != IntPtr.Zero)
             {
                 // Free the allocated memory
                 Marshal.FreeHGlobal(m_Buffer);
                 m_Buffer = IntPtr.Zero;
             }

         }

         public IEnumerable<String> EnumerateFiles(string szDriveLetter)
         {
             try
             {
                 var usnRecord = default(USN_RECORD);
                 var mft = default(MFT_ENUM_DATA);
                 var dwRetBytes = ;
                 var cb = ;
                 var dicFRNLookup = new Dictionary<long, FSNode>();
                 var bIsFile = false;

                 // This shouldn't be called more than once.
                 if (m_Buffer.ToInt32() != )
                 {
                     throw new Exception("invalid buffer");
                 }

                 // Assign buffer size
                 m_BufferSize = ;
                 //64KB

                 // Allocate a buffer to use for reading records.
                 m_Buffer = Marshal.AllocHGlobal(m_BufferSize);

                 // correct path
                 szDriveLetter = szDriveLetter.TrimEnd('\\');

                 // Open the volume handle
                 m_hCJ = OpenVolume(szDriveLetter);

                 // Check if the volume handle is valid.
                 if (m_hCJ == INVALID_HANDLE_VALUE)
                 {
                     string errorMsg = "Couldn't open handle to the volume.";
                     if (!IsAdministrator())
                         errorMsg += "Current user is not administrator";

                     throw new Exception(errorMsg);
                 }

                 mft.StartFileReferenceNumber = ;
                 mft.LowUsn = ;
                 mft.HighUsn = long.MaxValue;

                 do
                 {
                     if (DeviceIoControl(m_hCJ, FSCTL_ENUM_USN_DATA, ref mft, Marshal.SizeOf(mft), m_Buffer, m_BufferSize, ref dwRetBytes, IntPtr.Zero))
                     {
                         cb = dwRetBytes;
                         // Pointer to the first record
                         IntPtr pUsnRecord = new IntPtr(m_Buffer.ToInt32() + );

                         while ((dwRetBytes > ))
                         {
                             // Copy pointer to USN_RECORD structure.
                             usnRecord = (USN_RECORD)Marshal.PtrToStructure(pUsnRecord, usnRecord.GetType());

                             // The filename within the USN_RECORD.
                             string FileName = Marshal.PtrToStringUni(new IntPtr(pUsnRecord.ToInt32() + usnRecord.FileNameOffset), usnRecord.FileNameLength / );

                             bIsFile = !usnRecord.FileAttributes.HasFlag(FileAttributes.Directory);
                             dicFRNLookup.Add(usnRecord.FileReferenceNumber, new FSNode(usnRecord.FileReferenceNumber, usnRecord.ParentFileReferenceNumber, FileName, bIsFile));

                             // Pointer to the next record in the buffer.
                             pUsnRecord = new IntPtr(pUsnRecord.ToInt32() + usnRecord.RecordLength);

                             dwRetBytes -= usnRecord.RecordLength;
                         }

                         // The first 8 bytes is always the start of the next USN.
                         mft.StartFileReferenceNumber = Marshal.ReadInt64(m_Buffer, );

                     }
                     else
                     {
                         break; // TODO: might not be correct. Was : Exit Do

                     }

                 } while (!(cb <= ));

                 // Resolve all paths for Files
                 foreach (FSNode oFSNode in dicFRNLookup.Values.Where(o => o.IsFile))
                 {
                     string sFullPath = oFSNode.FileName;
                     FSNode oParentFSNode = oFSNode;

                     while (dicFRNLookup.TryGetValue(oParentFSNode.ParentFRN, out oParentFSNode))
                     {
                         sFullPath = string.Concat(oParentFSNode.FileName, @"\", sFullPath);
                     }
                     sFullPath = string.Concat(szDriveLetter, @"\", sFullPath);

                     yield return sFullPath;
                 }
             }
             finally
             {
                 //// cleanup
                 Cleanup();
             }
         }

         public static bool IsAdministrator()
         {
             WindowsIdentity identity = WindowsIdentity.GetCurrent();
             WindowsPrincipal principal = new WindowsPrincipal(identity);
             return principal.IsInRole(WindowsBuiltInRole.Administrator);
         }
     }

原文还提供了一个扩展方法，方便我们获取某个磁盘下的所有的文件名。

     public static class DriveInfoExtension
     {
         public static IEnumerable<String> EnumerateFiles(this DriveInfo drive)
         {
             return (new MFTScanner()).EnumerateFiles(drive.Name);
         }
     }

需要注意的是，读取USN Journal是需要管理员权限的，因此使用这个类需要管理员权限才能正常运行。

另外，这个类封装的也略为简单，只读取了文件名，实际上还可以读取文件大小，属性等常用信息，修改一下代码非常容易获取这些属性。通过它们可以非常方便写出一些分析磁盘空间占用的程序，这里就不举例了。