New
#11
Well-known problem starting at Windows 8. "Fast Startup" is modified hibernation (without user session) so it leaves disk volumes/filesystems in Dirty Shutdown state (does not dismount them) after "shutdown". Much worse, FCU re-enables this "feature" without notifying users.
Last edited by muchomurka; 11 Nov 2017 at 21:56.
You access the USN change journal using functionality analogous to fsutil's USN journal query functions.
See here for a brief overview of the architecture of Change Journal records on NTFS volumes. More details on how to work with Change Journal records are here.
Do you have experience with Windows systems-level programming if I may ask?