在 NTFS 卷上快速查找一组文件名，最好是通过其 MFT
我正在编写一个工具，可以查找 iTunes 库中丢失的文件，适用于 Mac 和 Windows。在Mac上，我可以使用奇妙的“CatalogSearch”功能通过命名快速查找文件。
然而，在 Windows 上，似乎没有用于按文件名搜索的操作系统 API（或者有吗？）。
经过一番谷歌搜索后，我了解到有一些工具（例如TFind、Everything）可以直接读取NTFS目录并扫描它以按名称查找文件。
我也想做同样的事情，但不必从头开始（虽然我过去写过不少磁盘工具，但我从来没有精力深入研究 NTFS）。
我想知道是否有现成的库（可能是 .dll），可以为我提供此搜索功能：传入文件名，获取其路径。
或者，Windows 索引服务怎么样？至少当我在最近安装的 XP Home 系统上尝试此操作时，开始菜单下的搜索操作实际上会扫描所有目录，这表明它没有完整的数据库。由于我根本不是 Windows 用户，我想知道为什么这不起作用。
最后，我需要的完整解决方案是：我有一个要查找的文件名列表，并且我需要搜索整个磁盘（或使用数据库）的代码来获取所有结果一口气。例如，搜索不应为我正在查找的每个文件启动新的完整扫描。这就是为什么我认为 MFT 方式是最佳的，因为它可以快速迭代所有名称，将每个名称与我的列表进行比较。
I am in the middle of writing a tool that finds lost files of an iTunes library, for both Mac and Windows. On the Mac, I can quickly find files by naming using the wonderful "CatalogSearch" function.
On Windows, however, there seems to be no OS API for searching by file name (or is there?).
After some googling, I learned that there are tools (like TFind, Everything) that read the NTFS directory directly and scan it to find files by name.
I would like to do the same, but without having to start from scratch (although I've written quite a few disk tools in the past, I've never had the energy to dig into NTFS).
I wonder if there are ready-made libs around, possibly as a .dll, that would give me this search feature: Pass in a file name, get back its path.
Alternatively, what about the Windows indexing service? At least when I tried this on a recently installed XP Home system, the Search operation under the Start menu would actually scan all directories, which suggests that it has no complete database. As I'm not a Windows user at all, I wonder why this isn't working.
In the end, the complete solution I need is: I have a list of file names to find, and I need code that searches the entire disk (or uses a DB for it) to get me all results in one go. E.g, the search should not start a new full scan for every file I'm looking up. That's why I think the MFT way would be optimal, as it could quickly iterate over all names, comparing each to my list.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
解决问题的最佳方法似乎是使用 Windows Change Journal。
问题：如果卷未启用它或者该卷是非 NTFS，则您需要回退（如果是 NTFS，则启用更改日志）。您还需要管理员权限才能访问变更日志。
您可以通过使用 FSCTL_ENUM_USN_DATA 和 LowUsn=0 的 DeviceIOControll 来获取文件。这直接访问 MFT 并将所有文件名写入提供的缓冲区。由于它按顺序访问 MFT，因此比 FindFirstFile API 更快。
The best way to solve your problem seems to be by using the Windows Change Journal.
Problem: If it is not enabled for a volume or the volume is a non-NTFS you need a fallback (or enable the Change Journal if it is NTFS). You need administrator rights as well to access the Change Journal.
You get the files by using the FSCTL_ENUM_USN_DATA and DeviceIOControll with LowUsn=0. This directly accesses the MFT and writes all filenames into the supplied buffer. Because it sequentially acesses the MFT it is faster than the FindFirstFile API.