Platform SDK: Hardware

FSCTL_DELETE_USN_JOURNAL

The FSCTL_DELETE_USN_JOURNAL operation deletes the change journal on a volume or awaits notification of deletion of a change journal.

To perform this operation, call the DeviceIoControl function using the following parameters.

BOOL DeviceIoControl(
  (HANDLE) hDevice,            // handle to volume
  FSCTL_DELETE_USN_JOURNAL,    // dwIoControlCode operation
  (LPVOID) lpInBuffer,         // input buffer
  (DWORD) nInBufferSize,       // size of input buffer
  NULL,                        // lpOutBuffer; must be NULL
  0,                           // nOutBufferSize; must be zero
  (LPDWORD) lpBytesReturned,   // number of bytes returned
  (LPOVERLAPPED) lpOverlapped  // OVERLAPPED structure
);

Parameters

hDevice
[in] Handle to the local volume from which the change journal is to be deleted. To obtain a volume handle, call the CreateFile function.
dwIoControlCode
[in] Control code for the operation. This value identifies the specific operation to be performed and the type of device on which to perform it. Use FSCTL_DELETE_USN_JOURNAL for this operation.
lpInBuffer
[in] Pointer to the input buffer, a DELETE_USN_JOURNAL_DATA structure.
nInBufferSize
[in] Size, in bytes, of the input buffer.
lpOutBuffer
[out] Pointer to the output buffer. Not used; must be NULL.
nOutBufferSize
[in] Size, in bytes, of the output buffer. Not used; must be zero.
lpBytesReturned
[out] Pointer to a variable that receives the actual count of bytes returned by the function in the output buffer. The lpBytesReturned value is meaningless until the operation is complete or if there is no output buffer. With an asynchronous call, the programmer must provide a non-NULL pointer to a valid value.

If lpOverlapped is NULL (nonoverlapped I/O), lpBytesReturned is used internally and cannot be NULL.

If lpOverlapped is not NULL (overlapped I/O), lpBytesReturned can be NULL.

lpOverlapped
[in] Pointer to an OVERLAPPED structure.

If hDevice was opened with the FILE_FLAG_OVERLAPPED flag, lpOverlapped must point to a valid OVERLAPPED structure. In this case, DeviceIoControl is performed as an overlapped (asynchronous) operation. If the device was opened with the FILE_FLAG_OVERLAPPED flag and lpOverlapped is NULL, the function fails in unpredictable ways.

If hDevice was opened without specifying the FILE_FLAG_OVERLAPPED flag, lpOverlapped is ignored and the DeviceIoControl function does not return until the operation has been completed, or until an error occurs.

Return Values

If the operation succeeds, DeviceIoControl returns a nonzero value.

If the operation fails, DeviceIoControl returns zero. To get extended error information, call GetLastError.

Possible return values include the following.

Value Meaning
ERROR_INVALID_FUNCTION The specified volume does not support change journals. Change journals are only supported on Windows 2000. Where supported, change journals can also be deleted.
ERROR_INVALID_PARAMETER One or more parameters was invalid. For example, DeviceIoControl returns this error code if the handle supplied is not a volume handle.
ERROR_JOURNAL_DELETE_IN_PROGRESS An attempt was made to read from, create, delete, or modify the journal while a journal deletion was under way, or an attempt was made to write a USN record while a journal deletion was under way.

Remarks

For the implications of overlapped I/O on this operation, see the Remarks section of the DeviceIoControl topic.

You can use FSCTL_DELETE_USN_JOURNAL to delete a change journal. NTFS starts the deletion operation and returns immediately to the calling process, unless the USN_DELETE_FLAG_NOTIFY flag is set in the DeleteFlags member of DELETE_USN_JOURNAL_DATA.

If the USN_DELETE_FLAG_NOTIFY and USN_DELETE_FLAG_DELETE flags are both set, a call to FSCTL_DELETE_USN_JOURNAL begins the deletion process. The call then either blocks the calling thread and awaits the deletion (on a synchronous or nonoverlapped call), or sets up event notification by using an I/O completion port or other mechanism and returns (on an asynchronous or overlapped call).

You can also use FSCTL_DELETE_USN_JOURNAL to obtain notification that a change journal deletion has been completed, by setting only USN_DELETE_FLAG_NOTIFY. If you do so, the FSCTL_DELETE_USN_JOURNAL operation either waits until the deletion completes before returning (on a synchronous or nonoverlapped call) or sets up event notification by using an I/O completion port or other mechanism (on an asynchronous or overlapped call).

The deletion on which your application receives notification may have been initiated by the current process, or some other process. For example, when your application is started, it can use FSCTL_DELETE_USN_JOURNAL to determine if a deletion started by some other process is in progress and, if so, exit.

Complete deletion of a change journal requires a scan of the volume on which the change journal resides, which may take a long time on a volume with many files. The operation continues to completion even across system restarts. Attempts to create, modify, delete, or query the change journal while deletion is in progress fail and return the error code ERROR_JOURNAL_DELETE_IN_PROGRESS.

The FSCTL_DELETE_USN_JOURNAL operation has a significant performance cost, so it should be used sparingly. An administrator should delete a journal when the current USN value approaches that of the maximum possible USN value.

To obtain a handle to a volume, pass in the CreateFile parameter lpFileName a value of the following form:

\\.\X:

where X is the letter identifying the drive on which the volume appears. The volume must be an NTFS volume on Windows 2000.

Requirements

  Windows NT/2000: Requires Windows 2000.
  Windows 95/98: Unsupported.
  Header: Declared in Winioctl.h.

See Also

Device Input and Output Overview, Device Input and Output Control Codes, CREATE_USN_JOURNAL_DATA, CreateFile, DELETE_USN_JOURNAL_DATA, DeviceIoControl, FSCTL_CREATE_USN_JOURNAL, OVERLAPPED