Retrieves the set of update sequence number (USN) change journal records between two specified USN values.

DeviceIoControl( (HANDLE)       hDevice,         // handle to volume
                 (DWORD) FSCTL_READ_USN_JOURNAL, // dwIoControlCode
                 (LPVOID)       lpInBuffer,      // input buffer
                 (DWORD)        nInBufferSize,   // size of input buffer
                 (LPVOID)       lpOutBuffer,     // output buffer
                 (DWORD)        nOutBufferSize,  // size of output buffer
                 (LPDWORD)      lpBytesReturned, // number of bytes returned
                 (LPOVERLAPPED) lpOverlapped );  // OVERLAPPED structure


To perform this operation, call the DeviceIoControl function with the following parameters.


A handle to the local volume from which change journal data is to be returned.

To retrieve a volume handle, call the CreateFile function.


The control code for the operation.

Use FSCTL_READ_USN_JOURNAL for this operation.


A pointer to the input buffer, a READ_USN_JOURNAL_DATA_V0 or READ_USN_JOURNAL_DATA_V1 structure.

The structure member BytesToWaitFor that indicates the size in bytes of unfiltered data to retrieve from the change journal, which should not exceed the size of the output buffer pointed to by the lpOutBuffer parameter.

The structure member Timeout is ignored for asynchronously opened handles.

Windows Server 2008 R2, Windows 7, Windows Server 2008, Windows Vista, Windows Server 2003 and Windows XP:  READ_USN_JOURNAL_DATA_V1 structures are not supported before Windows Server 2012.


The size of the input buffer, in bytes. The size specified determines whether the input structure is interpreted as a READ_USN_JOURNAL_DATA_V0 or READ_USN_JOURNAL_DATA_V1 structure.


A pointer to the output buffer that receives a USN followed by 0 (zero) or more USN_RECORD_V2, USN_RECORD_V3, or USN_RECORD_V4 structures. The USN is a DWORDLONG value that represents the USN that follows the last record in the buffer. It can be used in a subsequent call to FSCTL_READ_USN_JOURNAL to get the next set of records that follow those in the current output buffer.

For more information about navigating the data in the output buffer, see Walking a Buffer of Change Journal Records.

Windows Server 2008 R2, Windows 7, Windows Server 2008, Windows Vista, Windows Server 2003 and Windows XP:  USN_RECORD_V3 structures are not supported before Windows Server 2012, and USN_RECORD_V4 structures are not supported before Windows Server 2012 R2.


The size of the output buffer, in bytes.


A pointer to a variable that receives the size of the data that is stored in the output buffer, in bytes.

If the output buffer is too small, the call fails, GetLastError returns ERROR_INSUFFICIENT_BUFFER, and lpBytesReturned is 0 (zero).

If lpOverlapped is NULL, lpBytesReturned cannot be NULL. Even when an operation does not return output data and lpOutBuffer is NULL, DeviceIoControl uses lpBytesReturned. After such an operation, the value of lpBytesReturned is meaningless.

If lpOverlapped is not NULL, lpBytesReturned can be NULL. If this parameter is not NULL and the operation returns data, lpBytesReturned is meaningless until the overlapped operation is complete. To retrieve the number of bytes returned, call GetOverlappedResult. If hDevice is associated with an I/O completion port, you can retrieve the number of bytes returned by calling GetQueuedCompletionStatus.


A pointer to an OVERLAPPED structure.

If hDevice is opened without specifying FILE_FLAG_OVERLAPPED, lpOverlapped is ignored.

If hDevice is opened with the FILE_FLAG_OVERLAPPED flag, the operation is performed as an overlapped (asynchronous) operation. In this case, lpOverlapped must point to a valid OVERLAPPED structure that contains a handle to an event object. Otherwise, the function fails in unpredictable ways.

For overlapped operations, DeviceIoControl returns immediately, and the event object is signaled when the operation is complete. Otherwise, the function does not return until the operation is complete or an error occurs.

Return value

If the operation completes successfully, DeviceIoControl returns a nonzero value.

If the operation fails or is pending, DeviceIoControl returns 0 (zero), and the contents of the output buffer pointed to by lpOutBuffer are meaningless. To get extended error information, call GetLastError.

The possible return values include the following.

Return codeDescription

The specified volume does not support change journals. Where supported, change journals can also be deleted.


One or more parameters is invalid.

For example, DeviceIoControl returns this error code if the handle supplied is not a volume handle.


An attempt is made to read from, create, delete, or modify the journal while a journal deletion is in process, or an attempt is made to write a USN record while a journal deletion is in process.


An attempt is made to write a USN record or to read the change journal while the journal is inactive.


A nonzero USN is specified that is less than the first USN in the change journal.

The specified USN may have been valid at one time, but it has since been deleted.



For the implications of overlapped I/O on this operation, see the Remarks section of the DeviceIoControl topic.

There are two DeviceIoControl control codes that return USN records, FSCTL_READ_USN_JOURNAL and FSCTL_ENUM_USN_DATA. Use the latter when you want a listing (enumeration) of the USN records between two USNs. Use the former when you want to select by USN.

For more information, see Creating, Modifying, and Deleting a Change Journal.

To retrieve a handle to a volume, call CreateFile with the lpFileName parameter set to a string in the following form:


In the preceding string, X is the letter identifying the drive on which the volume appears. The volume must be NTFS.

In Windows 8 and Windows Server 2012, this code is supported by the following technologies.


Server Message Block (SMB) 3.0 protocol


SMB 3.0 Transparent Failover (TFO)


SMB 3.0 with Scale-out File Shares (SO)


Cluster Shared Volume File System (CsvFS)

See comment


An application may experience false positives on CsvFs pause/resume.


For an example, see Walking a Buffer of Change Journal Records.


Minimum supported client

Windows XP [desktop apps only]

Minimum supported server

Windows Server 2003 [desktop apps only]


WinIoCtl.h (include Windows.h)

See also

Change Journals
Volume Management Control Codes