Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How many file changes can be stored in an NTFS Change journal database with size 32MB for instance. How do I get from megabytes to amount of files?

share|improve this question
up vote 2 down vote accepted

The number of changes that a given USN journal file can hold can be estimated with the following formula:

journal size/((60 bytes + (length of file name)) * 2)

The number "2" in this formula stems from two journal entries for each file change: 1 for open and 1 for close. Divide the journal size by the size per change to determine the approximate number of changes that can occur before the journal wrap error is encountered. Assuming 8.3 filenames, this maps to approximately 200,000 files and/or directories for a 32 MB journal file. The number of changes would be less if long file names were used.

share|improve this answer

You can't because the records are variable length. Every record contains the name of the file that was modified.

You can determine the minimum number of records that can be stored by checking a particular record's RecordLength, adjusting it by the difference between it's FileNameLength and lpMaximumComponentLength returned from a call to GetVolumeInformation, and dividing that result into the size of the journal.

However, it's going to be pretty inaccurate since the overwhelming majority of file names on an NTFS drive are going to be significantly shorter than the maximum length.

share|improve this answer
As far as I know each record does not contain the full path, rather it contains the file name and the Parent FRN. See – Hannes de Jager May 6 '10 at 15:15
It seems you're right about that... Editing to fix. – afrazier May 6 '10 at 18:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.