USN_REASON_DATA_OVERWRITEUSN_REASON_DATA_EXTENDUSN_REASON_DATA_TRUNCATIONUSN_REASON_NAMED_DATA_OVERWRITEUSN_REASON_NAMED_DATA_EXTEND还有很多,想获取的是文件的操作记录,比如新建,修改删除等
在结构体上点右键,转到定义
https://technet.microsoft.com/zh-cn/subscriptions/hh802706