第C#實現快速查詢文件的方法相信使用過Everything的人都對其超快的搜索速度印象非常深刻，它的主要原理是通過掃描NTFS磁盤的USNJournal讀取的文件列表，而不是磁盤目錄，由于USNJournal非常小，因此能實現快速搜索。

由于.Net程序的Dll基本上是通用的，在C#中也可以直接使用它。

publicclassMFTScanner

privatestaticIntPtrINVALID_HANDLE_VALUE=newIntPtr(-1);

privateconstuintGENERIC_READ=0x80000000;

privateconstintFILE_SHARE_READ=0x1;

privateconstintFILE_SHARE_WRITE=0x2;

privateconstintOPEN_EXISTING=3;

privateconstintFILE_READ_ATTRIBUTES=0x80;

privateconstintFILE_NAME_IINFORMATION=9;

privateconstintFILE_FLAG_BACKUP_SEMANTICS=0x2000000;

privateconstintFILE_OPEN_FOR_BACKUP_INTENT=0x4000;

privateconstintFILE_OPEN_BY_FILE_ID=0x2000;

privateconstintFILE_OPEN=0x1;

privateconstintOBJ_CASE_INSENSITIVE=0x40;

privateconstintFSCTL_ENUM_USN_DATA=0x900b3;

[StructLayout(LayoutKind.Sequential)]

privatestructMFT_ENUM_DATA

publiclongStartFileReferenceNumber;

publiclongLowUsn;

publiclongHighUsn;

[StructLayout(LayoutKind.Sequential)]

privatestructUSN_RECORD

publicintRecordLength;

publicshortMajorVersion;

publicshortMinorVersion;

publiclongFileReferenceNumber;

publiclongParentFileReferenceNumber;

publiclongUsn;

publiclongTimeStamp;

publicintReason;

publicintSourceInfo;

publicintSecurityId;

publicFileAttributesFileAttributes;

publicshortFileNameLength;

publicshortFileNameOffset;

[StructLayout(LayoutKind.Sequential)]

privatestructIO_STATUS_BLOCK

publicintStatus;

publicintInformation;

[StructLayout(LayoutKind.Sequential)]

privatestructUNICODE_STRING

publicshortLength;

publicshortMaximumLength;

publicIntPtrBuffer;

[StructLayout(LayoutKind.Sequential)]

privatestructOBJECT_ATTRIBUTES

publicintLength;

publicIntPtrRootDirectory;

publicIntPtrObjectName;

publicintAttributes;

publicintSecurityDescriptor;

publicintSecurityQualityOfService;

////MFT_ENUM_DATA

[DllImport("kernel32.dll",ExactSpelling=true,SetLastError=true,CharSet=CharSet.Auto)]

privatestaticexternboolDeviceIoControl(IntPtrhDevice,intdwIoControlCode,refMFT_ENUM_DATAlpInBuffer,intnInBufferSize,IntPtrlpOutBuffer,intnOutBufferSize,refintlpBytesReturned,IntPtrlpOverlapped);

[DllImport("kernel32.dll",SetLastError=true,CharSet=CharSet.Auto)]

privatestaticexternIntPtrCreateFile(stringlpFileName,uintdwDesiredAccess,intdwShareMode,IntPtrlpSecurityAttributes,intdwCreationDisposition,intdwFlagsAndAttributes,IntPtrhTemplateFile);

[DllImport("kernel32.dll",ExactSpelling=true,SetLastError=true,CharSet=CharSet.Auto)]

privatestaticexternInt32CloseHandle(IntPtrlpObject);

[DllImport("ntdll.dll",ExactSpelling=true,SetLastError=true,CharSet=CharSet.Auto)]

privatestaticexternintNtCreateFile(refIntPtrFileHandle,intDesiredAccess,refOBJECT_ATTRIBUTESObjectAttributes,refIO_STATUS_BLOCKIoStatusBlock,intAllocationSize,intFileAttribs,intSharedAccess,intCreationDisposition,intCreateOptions,intEaBuffer,

intEaLength);

[DllImport("ntdll.dll",ExactSpelling=true,SetLastError=true,CharSet=CharSet.Auto)]

privatestaticexternintNtQueryInformationFile(IntPtrFileHandle,refIO_STATUS_BLOCKIoStatusBlock,IntPtrFileInformation,intLength,intFileInformationClass);

privateIntPtrm_hCJ;

privateIntPtrm_Buffer;

privateintm_BufferSize;

privatestringm_DriveLetter;

privateclassFSNode

publiclongFRN;

publiclongParentFRN;

publicstringFileName;

publicboolIsFile;

publicFSNode(longlFRN,longlParentFSN,stringsFileName,boolbIsFile)

FRN=lFRN;

ParentFRN=lParentFSN;

FileName=sFileName;

IsFile=bIsFile;

privateIntPtrOpenVolume(stringszDriveLetter)

IntPtrhCJ=default(IntPtr);

/