In Progress

NTFS disk scan (using MFT) and Change Journal

The attached Delphi XE2 project uses MFT to do a fast NFTS disk scan.

I'm looking for someone to add the following changes (either by directly editing the Delphi code, or by converting the C# code provided @ the end of this decription):

1. Query the change journal to get the newly modified files (changed, renamed, deleted, etc...)

You'll find two broken attempts in [url removed, login to view] --> GetRecentChanges() and EnumUsnEntries(), you may wanna take a look at it, just in case.

2. Restrict scan to a certain folder

If I'm not mistaken, it's possible to partially do so by defining the StartUsn in the EnumMFTEntries() function, but it's not clear to me how to do that.

3. Get the full path of a file name

For example, the EnumMFTEntries() always return the name only, along with its parent folder reference number, it's not clear what's the fastest way to get the full path.

The C# in question is here:

C# code: [url removed, login to view] (click the download link & take a look at this file: USNJournal\[url removed, login to view] it does contains the code you'll convert)

Blog Post [url removed, login to view]

I already posted a question here:

[url removed, login to view]

but it didn't get any feedback, now I need someone proficient enough in either Delphi and/or C# to get these tasks done.

This is a couple hours work for someone who knows the subject, but a real headache for me :(


1. I'm after the speed, crazy fast speed, if your code works but is slow, I just won't accept it. I cannot stress enough on this point!

2. The code must work in Delphi XE2. It also must works on Windows XP or later

Skills: C# Programming, Delphi, Software Architecture, Software Testing, Windows Desktop

See more: ntfs change journal, mftscanner, delphi mft, mft, ntfs journal, ntfs usn journal, change journal ntfs, delphi ntfs mft, ntfs mft delphi, mft change journal, change journal, usn journal, delphi ntfs usn, mft entry, delphi scan mft, usn change journal, scan deleted file using, enummftentries delphi, ntfs mft, delphi mft usn, usn mft, scan ntfs journal, usn journal project, ntfs usn, ntfs usn change journal

About the Employer:
( 22 reviews ) Boulogne Billancourt, Tunisia

Project ID: #4188616

Awarded to:


Greetings, I have large experience in low-level WinApi area. Please check inbox for more details.

$300 USD in 10 days
(3 Reviews)

5 freelancers are bidding on average $516 for this job


Details in PMB.

$1000 USD in 14 days
(28 Reviews)

Well,GetRecentChanges fails on the very beginning, calling SCTL_READ_USN_JOURNAL Here the sample of the app, showing last changes within 5 min on drive C. [url removed, login to view] I didn't work with lowlevel NT More

$330 USD in 8 days
(16 Reviews)

Hi, we are interested in your project. we can start work on your project as soon as you provide us chance of working with you

$750 USD in 30 days
(10 Reviews)

I am ready to assist. Thanks.

$200 USD in 7 days
(5 Reviews)