using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Runtime.InteropServices;
using Microsoft.VisualBasic;public class MFTScanner
{private static IntPtr INVALID_HANDLE_VALUE = new IntPtr(-1);private const uint GENERIC_READ = 0x80000000;private const int FILE_SHARE_READ = 0x1;private const int FILE_SHARE_WRITE = 0x2;private const int OPEN_EXISTING = 3;private const int FILE_READ_ATTRIBUTES = 0x80;private const int FILE_NAME_IINFORMATION = 9;private const int FILE_FLAG_BACKUP_SEMANTICS = 0x2000000;private const int FILE_OPEN_FOR_BACKUP_INTENT = 0x4000;private const int FILE_OPEN_BY_FILE_ID = 0x2000;private const int FILE_OPEN = 0x1;private const int OBJ_CASE_INSENSITIVE = 0x40;private const int FSCTL_ENUM_USN_DATA = 0x900b3;[StructLayout(LayoutKind.Sequential)]private struct MFT_ENUM_DATA{public long StartFileReferenceNumber;public long LowUsn;public long HighUsn;}[StructLayout(LayoutKind.Sequential)]private struct USN_RECORD{public int RecordLength;public short MajorVersion;public short MinorVersion;public long FileReferenceNumber;public long ParentFileReferenceNumber;public long Usn;public long TimeStamp;public int Reason;public int SourceInfo;public int SecurityId;public FileAttribute FileAttributes;public short FileNameLength;public short FileNameOffset;}[StructLayout(LayoutKind.Sequential)]private struct IO_STATUS_BLOCK{public int Status;public int Information;}[StructLayout(LayoutKind.Sequential)]private struct UNICODE_STRING{public short Length;public short MaximumLength;public IntPtr Buffer;}[StructLayout(LayoutKind.Sequential)]private struct OBJECT_ATTRIBUTES{public int Length;public IntPtr RootDirectory;public IntPtr ObjectName;public int Attributes;public int SecurityDescriptor;public int SecurityQualityOfService;}MFT_ENUM_DATA[DllImport("kernel32.dll", ExactSpelling = true, SetLastError = true, CharSet = CharSet.Auto)]private static extern bool DeviceIoControl(IntPtr hDevice, int dwIoControlCode, ref MFT_ENUM_DATA lpInBuffer, int nInBufferSize, IntPtr lpOutBuffer, int nOutBufferSize, ref int lpBytesReturned, IntPtr lpOverlapped);[DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Auto)]private static extern IntPtr CreateFile(string lpFileName, uint dwDesiredAccess, int dwShareMode, IntPtr lpSecurityAttributes, int dwCreationDisposition, int dwFlagsAndAttributes, IntPtr hTemplateFile);[DllImport("kernel32.dll", ExactSpelling = true, SetLastError = true, CharSet = CharSet.Auto)]private static extern Int32 CloseHandle(IntPtr lpObject);[DllImport("ntdll.dll", ExactSpelling = true, SetLastError = true, CharSet = CharSet.Auto)]private static extern int NtCreateFile(ref IntPtr FileHandle, int DesiredAccess, ref OBJECT_ATTRIBUTES ObjectAttributes, ref IO_STATUS_BLOCK IoStatusBlock, int AllocationSize, int FileAttribs, int SharedAccess, int CreationDisposition, int CreateOptions, int EaBuffer,int EaLength);[DllImport("ntdll.dll", ExactSpelling = true, SetLastError = true, CharSet = CharSet.Auto)]private static extern int NtQueryInformationFile(IntPtr FileHandle, ref IO_STATUS_BLOCK IoStatusBlock, IntPtr FileInformation, int Length, int FileInformationClass);private IntPtr m_hCJ;private IntPtr m_Buffer;private int m_BufferSize;private string m_DriveLetter;private class FSNode{public long FRN;public long ParentFRN;public string FileName;public bool IsFile;public FSNode(long lFRN, long lParentFSN, string sFileName, bool bIsFile){FRN = lFRN;ParentFRN = lParentFSN;FileName = sFileName;IsFile = bIsFile;}}private IntPtr OpenVolume(string szDriveLetter){IntPtr hCJ = default(IntPtr);volume handlem_DriveLetter = szDriveLetter;hCJ = CreateFile("\\\\.\\" + szDriveLetter, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE, IntPtr.Zero, OPEN_EXISTING, 0, IntPtr.Zero);return hCJ;}private void Cleanup(){if (m_hCJ != IntPtr.Zero){// Close the volume handle.CloseHandle(m_hCJ);m_hCJ = INVALID_HANDLE_VALUE;}if (m_Buffer != IntPtr.Zero){// Free the allocated memoryMarshal.FreeHGlobal(m_Buffer);m_Buffer = IntPtr.Zero;}}public IEnumerable<String> EnumerateFiles(string szDriveLetter){try{var usnRecord = default(USN_RECORD);var mft = default(MFT_ENUM_DATA);var dwRetBytes = 0;var cb = 0;var dicFRNLookup = new Dictionary<long, FSNode>();var bIsFile = false;// This shouldn't be called more than once.if (m_Buffer.ToInt32() != 0){throw new Exception("invalid buffer");}// Assign buffer sizem_BufferSize = 65536;//64KB// Allocate a buffer to use for reading records.m_Buffer = Marshal.AllocHGlobal(m_BufferSize);// correct pathszDriveLetter = szDriveLetter.TrimEnd('\\');// Open the volume handle m_hCJ = OpenVolume(szDriveLetter);// Check if the volume handle is valid.if (m_hCJ == INVALID_HANDLE_VALUE){throw new Exception("Couldn't open handle to the volume.");}mft.StartFileReferenceNumber = 0;mft.LowUsn = 0;mft.HighUsn = long.MaxValue;do{if (DeviceIoControl(m_hCJ, FSCTL_ENUM_USN_DATA, ref mft, Marshal.SizeOf(mft), m_Buffer, m_BufferSize, ref dwRetBytes, IntPtr.Zero)){cb = dwRetBytes;// Pointer to the first recordIntPtr pUsnRecord = new IntPtr(m_Buffer.ToInt32() + 8);while ((dwRetBytes > 8)){// Copy pointer to USN_RECORD structure.usnRecord = (USN_RECORD)Marshal.PtrToStructure(pUsnRecord, usnRecord.GetType());// The filename within the USN_RECORD.string FileName = Marshal.PtrToStringUni(new IntPtr(pUsnRecord.ToInt32() + usnRecord.FileNameOffset), usnRecord.FileNameLength / 2);bIsFile = !usnRecord.FileAttributes.HasFlag(FileAttribute.Directory);dicFRNLookup.Add(usnRecord.FileReferenceNumber, new FSNode(usnRecord.FileReferenceNumber, usnRecord.ParentFileReferenceNumber, FileName, bIsFile));// Pointer to the next record in the buffer.pUsnRecord = new IntPtr(pUsnRecord.ToInt32() + usnRecord.RecordLength);dwRetBytes -= usnRecord.RecordLength;}// The first 8 bytes is always the start of the next USN.mft.StartFileReferenceNumber = Marshal.ReadInt64(m_Buffer, 0);}else{break; // TODO: might not be correct. Was : Exit Do}} while (!(cb <= 8));// Resolve all paths for Filesforeach (FSNode oFSNode in dicFRNLookup.Values.Where(o => o.IsFile)){string sFullPath = oFSNode.FileName;FSNode oParentFSNode = oFSNode;while (dicFRNLookup.TryGetValue(oParentFSNode.ParentFRN, out oParentFSNode)){sFullPath = string.Concat(oParentFSNode.FileName, "\\", sFullPath);}sFullPath = string.Concat(szDriveLetter, "\\", sFullPath);yield return sFullPath;}}finally{cleanupCleanup();}}
}

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.IO;
using System.Diagnostics;namespace ConsoleApplication28
{class Program{static void Main(string[] args){var sw = Stopwatch.StartNew();var files = EnumerateFiles("f:").ToArray();var elapsed = sw.ElapsedMilliseconds.ToString();Console.WriteLine(string.Format("Found {0} files, elapsed {1} ms", files.Length, elapsed));}}
}