Crate usn_journal_rs 

usn-journal-rs

A Rust library for manipulating the NTFS/ReFS USN change journal and enumerating the NTFS Master File Table (MFT).

This crate provides safe, ergonomic abstractions for accessing the USN change journal and MFT records on NTFS volumes. It enables applications to efficiently monitor, enumerate file system changes on Windows.

Features

• Enumerate USN journal records or MFT entries as Rust iterators
• Resolve file IDs to full paths
• Safe wrappers over Windows API calls

Example: Enumerate USN Journal

use usn_journal_rs::{volume::Volume, journal::UsnJournal};

let drive_letter = 'C';
let volume = Volume::from_drive_letter(drive_letter).unwrap();
let journal = UsnJournal::new(&volume);
for result in journal.iter().unwrap().take(10) {
    match result {
        Ok(entry) => println!("USN entry: {entry:?}"),
        Err(e) => eprintln!("Error reading entry: {e}"),
    }
}

Example: Enumerating MFT Entries

use usn_journal_rs::{volume::Volume, mft::Mft};

let drive_letter = 'C';
let volume = Volume::from_drive_letter(drive_letter).unwrap();
let mft = Mft::new(&volume);
for result in mft.iter().take(10) {
    match result {
        Ok(entry) => println!("MFT entry: {entry:?}"),
        Err(e) => eprintln!("Error reading MFT entry: {e}"),
    }
}

Platform

• Windows NTFS/ReFS volumes
• Requires appropriate privileges to access the USN journal

License

MIT License. See LICENSE.

Re-exports

pub use errors::UsnError;

Modules

errors

This module defines the custom error types.

journal

Provides access to the Windows NTFS/ReFS USN change journal.

mft

Represents the Master File Table (MFT) enumerator for a given NTFS volume.

path

Path resolution utilities for NTFS/ReFS volumes.

volume

Volume handle management for NTFS/ReFS

Constants

DEFAULT_JOURNAL_ALLOCATION_DELTA

DEFAULT_JOURNAL_MAX_SIZE

USN_REASON_MASK_ALL

Type Aliases

Usn

UsnResult

A convenient type alias for Results with UsnError.