DeviceIoControl with FSCTL_READ_FILE_USN_DATA (help with set up) Error 122 ERROR_INSUFFICIENT_BUFFER

[Striebrovlas]

I am trying get USN from file with this function

void GetUsnFromFF(std::wstring path, USN &usn)
{
HANDLE ff;
DWORD oBytes;

USN_RECORD_V2 usn_record;
std::wstring ppatch = L"\\\\.\\" + path;
if ((ff = CreateFile(
path.c_str() // E:\\SomePath\\ToDocument\\File.txt
, GENERIC_READ
, FILE_SHARE_READ | FILE_SHARE_WRITE
, NULL
, OPEN_EXISTING
, FILE_FLAG_BACKUP_SEMANTICS
, NULL
)) == INVALID_HANDLE_VALUE)
{
usn = 0;
printf("[ GetUsnFromFF ] CreateFile failed (%d)\n", GetLastError());
return;
}

if (!DeviceIoControl(
ff // handle to device
, FSCTL_READ_FILE_USN_DATA // dwIoControlCode
, NULL // input buffer
, 0 // size of input buffer
, &usn_record //record // output buffer
, sizeof(usn_record) // size of output buffer
, &oBytes // number of bytes returned
, NULL // OVERLAPPED structure
))
{
usn = 0;
printf("[ GetUsnFromFF ] FSCTL_READ_FILE_USN_DATA failed (%d)\n", GetLastError());
return;
}

std::wstring text = usn_record.FileName;
std::wcout << "File : " << text << "\n";
std::wcout << "USN : " << usn_record.Usn << "\n";
usn = usn_record.Usn;
}

from reading this documentation for FSCTL_READ_FILE_USN_DATA "If the output buffer is too small, the call fails, GetLastError returns ERROR_INSUFFICIENT_BUFFER, and lpBytesReturned is zero."

How to do it right?

Continue reading...