Implement Change Journal in Delphi

Question

I'm seeking to use Change Journal instead of ReadDirectoryChangesW to track changes in my delphi XE2 application (as for why: ReadDirectoryChangesW is not that reliable)

The closest I could find in delphi/pascal is something called Delphi MFT/Journal helpers, it contains two pascal units: uMFT.pas and uDevNotification.pas.

The code above deal with MFT (very nicely actually), but nothing as far change journal goes.

I also found this C# code, which seems to do what I want, only it's in C#

My question is: anyone knows a Delphi XE2 code (or how to convert the C# code) to interact with and/or query the change journal?

As I said, my goal is to replace the ReadDirectoryChangesW, so I ultimately need to interact with the change journal so that I'm notified whenever there's a change in the filesystem

Pleiades

And are you sure that this is what you want to do? It only applies to NTFS file systems. I'm not sure if it will work for network volumes. And the app will require admin rights to access a volume wide change journal. – Knead

@DavidHeffernan Good points: my app already requires admin access and, in this case, ReadDirectoryChangesW would be the fallback solution (the uMFT does detect NTFS volumes). Supporting network volumes would be nice, but not really important right now. – Pleiades

uMFT.pas has QueryUSNJournal() and EnumMFTEntries() functions for accessing the records of the Change Journal. Did you actually try using them yet? The MFT naming is just because the Master File Table uses the same record format as the Change Journal, so the same code can be used to enumerate records in both tables. – Gelation

Did you look at these articles: microsoft.com/msj/0999/journal/journal.aspx microsoft.com/msj/1099/journal2/journal2.aspx Frankly if you want to do low-level stuff like this you need to be skilled enough to port from C++ code to Delphi. It should be easy enough I think. – Knead

@RemyLebeau: I did use EnumMFTEntries but I missed QueryUSNJournal. I'll study it, but it seems the way to go according to this description...Do I take it the change journal has no notification mechanism? – Pleiades

@DavidHeffernan: No I didn't, thank a lot, I'll take a look at them – Pleiades

@DavidHeffernan: (thinking out loud here...) Since the change journal has no notification mechanism (or so it seems), I could probably still rely on ReadDirectoryChangesW to catch changes, and then use the changes journal to reliably get the modification date. That would fix my other issue about the unreliable file modification time. Does that make sense? – Pleiades

Yes, that makes good sense. – Knead

Please note that in 64-bit applications uMFT.pas will not work reliably any more. You will have to replace the Integer/Cardinal casts with their NativeInt/NativeUInt counterparts. Unfortunately you will not notice this if GetMem by chance will choose a low memory address. – Meraz