proxb / poshusnjournal Goto Github PK

I created a new journal on a non OS drive using a New-UsnJournal command.

Deleted a file on the drive.

Tried to do a Get-UsnJournalEntry and it did not return any results.

and I get WARNING: Issue occurred reading Usn entries!

Get-UsnJournal entry works on the OS drive though.

I tried the same on a different non OS drive as well, same thing happens.

get-usnjournalentry d: fails but the comand fsutil usn readjournal d: works.

what can be the issue?

Hi,
I have this error when, I'm trying to load module.
PS > Import-Module PoshUSNJournal
AVERTISSEMENT : Get-UsnJournal.ps1: Au caractère
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\PoshUSNJournal\Scripts\Get-UsnJournal.ps1:29 : 5

• [OutputType('System.Journal.UsnJournal')]
  

• ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  Attribut inattendu « OutputType ».

Au caractère C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\PoshUSNJournal\Scripts\Get-UsnJournal.ps1:30 : 5

• Param ($DriveLetter = 'C:')
  

• ~~~~~
  

  Jeton inattendu « Param » dans l'expression ou l'instruction.

Any idea why ?
Many thanks 💯
Regards,
Christophe

PS > $PSVersionTable

Name Value

PSVersion 4.0
WSManStackVersion 3.0
SerializationVersion 1.1.0.1
CLRVersion 4.0.30319.42000
BuildVersion 6.3.9600.16394
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0}
PSRemotingProtocolVersion 2.2

Via PowerShellGallery contact:

Hi,

I have found a bug in the module PoShUsnJournal. In the file PoShUsnJournal.psm1 at line 590: The function "GetFilePath" uses the parameter "PFileRefNumber" as an int64, but the USN-Journal itself uses Uint64! - the real problem is: [void][System.Runtime.InteropServices.Marshal]::WriteInt64($RefPtr, $PFileRefNumber) This does not work if you get a FileReferenceNumber thats too large for int64. Is it possible to write a bugfix?

best regards
chirsitian hiebler

I'm wrapping this module with my own script and whenever the FRN for a file is larger than 19 characters PoshUSNJournal throws the following exception.

Cannot convert argument "val", with value: "10261451750963675185", for "WriteInt64" to type "System.Int64": "Cannot
convert value "10261451750963675185" to type "System.Int64". Error: "Value was either too large or too small for an
Int64.""

I believe this may be because the FRN is being declared as an int64 value and I'm seeing FRN's larger than this.

Get-UsnJournalEntry does not work on non C drive letters. Pull request submitted #2 to correct this issue.