我想我会把这个放在这里给像我这样的人研究
FRN
和
OBJECTID
s、 对于单个文件系统上的目录(文件还原除外),这些id可能是稳定的,但是当您使用许多不同的应用程序保存和关闭文件时,FRN和ObjectID都将更改。
例如,如果使用FRN#:1000打开一个Word文件,并且指定了OBJECTID:8675309,则在进行更改时,请保存并关闭该文件。FRN将是一个新号码,不会有ObjectID。
在下面我做了一个简单的打开,修改了一段文字,保存并关闭了一个word文件。有超过52个事件,在我的程序中,我已经过滤掉了所有
~WRL*tmp
涉及的文件等。但是,即使在具有相同文件的同一文件系统上,FRN也不是一个不变的东西。我目前没有ObjectID显示,但相信我,当你分配一个,打开这个文件并保存它,它本质上是一个新的文件。
示例USN日志输出,第一个数字是文件引用号,第二个是父文件引用35;(稳定目录的FRN)
viewchanges
562949953421470 | 2251799813685402 | FILE | 7/10/2014 8:12:13 PM | \MyDemo\WordFileDemo.docx
OBJECT ID CHANGE
----------------------------------------------------------------------------------------------------
562949953421470 | 2251799813685402 | FILE | 7/10/2014 8:12:13 PM | \MyDemo\WordFileDemo.docx
OBJECT ID CHANGE
CLOSE
----------------------------------------------------------------------------------------------------
562949953421470 | 2251799813685402 | FILE | 7/10/2014 8:12:19 PM | \MyDemo\WordFileDemo.docx
RENAME OLD NAME
----------------------------------------------------------------------------------------------------
1125899906842780 | 2251799813685402 | FILE | 7/10/2014 8:12:19 PM | \MyDemo\WordFileDemo.docx
SECURITY CHANGE
RENAME NEW NAME
BASIC INFO CHANGE
OBJECT ID CHANGE
----------------------------------------------------------------------------------------------------
1125899906842780 | 2251799813685402 | FILE | 7/10/2014 8:12:19 PM | \MyDemo\WordFileDemo.docx
SECURITY CHANGE
RENAME NEW NAME
BASIC INFO CHANGE
OBJECT ID CHANGE
CLOSE
----------------------------------------------------------------------------------------------------
1125899906842780 | 2251799813685402 | FILE | 7/10/2014 8:12:19 PM | \MyDemo\WordFileDemo.docx
SECURITY CHANGE
----------------------------------------------------------------------------------------------------
1125899906842780 | 2251799813685402 | FILE | 7/10/2014 8:12:19 PM | \MyDemo\WordFileDemo.docx
SECURITY CHANGE
CLOSE
----------------------------------------------------------------------------------------------------
1125899906842780 | 2251799813685402 | FILE | 7/10/2014 8:12:19 PM | \MyDemo\WordFileDemo.docx
OBJECT ID CHANGE
----------------------------------------------------------------------------------------------------
1125899906842780 | 2251799813685402 | FILE | 7/10/2014 8:12:19 PM | \MyDemo\WordFileDemo.docx
OBJECT ID CHANGE
CLOSE
----------------------------------------------------------------------------------------------------
1125899906842780 | 2251799813685402 | FILE | 7/10/2014 8:12:19 PM | \MyDemo\WordFileDemo.docx
RENAME OLD NAME
----------------------------------------------------------------------------------------------------
1125899906842781 | 2251799813685402 | FILE | 7/10/2014 8:12:19 PM | \MyDemo\WordFileDemo.docx
SECURITY CHANGE
RENAME NEW NAME
BASIC INFO CHANGE
OBJECT ID CHANGE
----------------------------------------------------------------------------------------------------
1125899906842781 | 2251799813685402 | FILE | 7/10/2014 8:12:19 PM | \MyDemo\WordFileDemo.docx
SECURITY CHANGE
RENAME NEW NAME
BASIC INFO CHANGE
OBJECT ID CHANGE
CLOSE
----------------------------------------------------------------------------------------------------
1125899906842781 | 2251799813685402 | FILE | 7/10/2014 8:12:19 PM | \MyDemo\WordFileDemo.docx
SECURITY CHANGE
----------------------------------------------------------------------------------------------------
1125899906842781 | 2251799813685402 | FILE | 7/10/2014 8:12:19 PM | \MyDemo\WordFileDemo.docx
SECURITY CHANGE
CLOSE
----------------------------------------------------------------------------------------------------