USN journal for hard links

Question

If i have a directory with a few hardlinks all pointing to files outside the directory, will a change to one of the hardlinks affect the USN journal associated with the directory or will it affect the USN journal of the original directory which contains the actual file to which the hardlinks are linked at the time of their creation?

Answer 1

The journal will get an entry when you add the hard-link USN_REASON_HARD_LINK_CHANGE. Then as time goes on, any of the hard links may be opened, and changes made. The subsequent USN entries will all reference the original file's FileReferenceNumber, but will contain FileName and ParentFileReferenceNumber that depend on which link was actually opened. This is what you have available to distinguish between links. Note that it might be tempting to distinguish using only the ParentFileReferenceNumber, but this isn't really safe. While the most widely used pattern is to have the same-named link in different directories, you could have a link in the same directory but with a different name.

Note on moved links: If you choose to read the USN in "summary mode" (your READ_USN_JOURNAL_DATA_V0 has ReturnOnlyOnClose = 1), where you only read the entries that have accumulated to the point of the file closing, you can miss the USN_REASON_RENAME_OLD_NAME entries...and lose track of which link the rename was made through. This kind of USN record doesn't accumulate into the file close event...I'm guessing because of the potential collision of ParentFileReferenceNumber and FileName.