Retrieves the update sequence number (USN) change-journal information for the specified file or directory.

To perform this operation, call the DeviceIoControl function with the following parameters.

DeviceIoControl( (HANDLE)       hDevice,         // handle to device
                 (DWORD) FSCTL_READ_FILE_USN_DATA, // dwIoControlCode
                 (LPVOID)       lpInBuffer,      // input buffer
                 (DWORD)        nInBufferSize,   // size of input buffer
                 (LPVOID)       lpOutBuffer,     // output buffer
                 (DWORD)        nOutBufferSize,  // size of output buffer
                 (LPDWORD)      lpBytesReturned, // number of bytes returned
                 (LPOVERLAPPED) lpOverlapped );  // OVERLAPPED structure



A handle to the file or directory; this handle is returned by the CreateFile function.


The control code for the operation. Use FSCTL_READ_FILE_USN_DATA for this operation.

lpInBuffer [optional]

Optional address of a READ_FILE_USN_DATA structure that describes the versions of the USN change journal supported by the application. If this buffer is not specified then only data from version 2 of the USN change journal will be returned.

Windows Server 2008 R2, Windows 7, Windows Server 2008, Windows Vista, Windows Server 2003 and Windows XP:  READ_FILE_USN_DATA is not supported until Windows Server 2012. Use NULL.


The size of the input buffer, in bytes.


A pointer to the output buffer, a USN_RECORD_V2 or USN_RECORD_V3 structure.

Windows Server 2008 R2, Windows 7, Windows Server 2008, Windows Vista, Windows Server 2003 and Windows XP:  USN_RECORD_V3 is not supported until Windows Server 2012.


The size of the output buffer, in bytes.


A pointer to a variable that receives the size of the data stored in the output buffer, in bytes.

If the output buffer is too small, the call fails, GetLastError returns ERROR_INSUFFICIENT_BUFFER, and lpBytesReturned is zero.

If lpOverlapped is NULL, lpBytesReturned cannot be NULL. Even when an operation returns no output data and lpOutBuffer is NULL, DeviceIoControl makes use of lpBytesReturned. After such an operation, the value of lpBytesReturned is meaningless.

If lpOverlapped is not NULL, lpBytesReturned can be NULL. If this parameter is not NULL and the operation returns data, lpBytesReturned is meaningless until the overlapped operation has completed. To retrieve the number of bytes returned, call GetOverlappedResult. If hDevice is associated with an I/O completion port, you can retrieve the number of bytes returned by calling GetQueuedCompletionStatus.


A pointer to an OVERLAPPED structure.

If hDevice was opened without specifying FILE_FLAG_OVERLAPPED, lpOverlapped is ignored.

If hDevice was opened with the FILE_FLAG_OVERLAPPED flag, the operation is performed as an overlapped (asynchronous) operation. In this case, lpOverlapped must point to a valid OVERLAPPED structure that contains a handle to an event object. Otherwise, the function fails in unpredictable ways.

For overlapped operations, DeviceIoControl returns immediately, and the event object is signaled when the operation has been completed. Otherwise, the function does not return until the operation has been completed or an error occurs.

Return value

If the operation completes successfully, DeviceIoControl returns a nonzero value.

If the operation fails or is pending, DeviceIoControl returns zero. To get extended error information, call GetLastError.


If the call succeeds, the members of the returned USN_RECORD_V2 or USN_RECORD_V3 structure are valid except for the following members: TimeStamp, Reason, and SourceInfo. The Usn member represents the last USN written to the journal for this file or directory.

For more information, see Creating, Modifying, and Deleting a Change Journal.

To retrieve a handle to a volume, call CreateFile with the lpFileName parameter set to a string in the following form:


In the preceding string, X is the letter identifying the drive on which the volume appears. The volume must be ReFS or NTFS 3.0 or later. To obtain the NTFS version of a volume, open a command prompt with Administrator access rights and execute the following command:

FSUtil.exe FSInfo NTFSInfo X:

where X is the drive letter of the volume.

In Windows 8 and Windows Server 2012, this code is supported by the following technologies.


Server Message Block (SMB) 3.0 protocol


SMB 3.0 Transparent Failover (TFO)


SMB 3.0 with Scale-out File Shares (SO)


Cluster Shared Volume File System (CsvFS)




Minimum supported client

Windows XP [desktop apps only]

Minimum supported server

Windows Server 2003 [desktop apps only]


WinIoCtl.h (include Windows.h)

See also

Volume Management Control Codes