2.3.62.3 USN_RECORD_V3

The USN_RECORD_V3 element is as follows.

0	1	2	3	4	5	6	7	8	9	1 0	1	2	3	4	5	6	7	8	9	2 0	1	2	3	4	5	6	7	8	9	3 0	1
RecordLength
MajorVersion																MinorVersion
FileReferenceNumber (16 bytes)
...
...
ParentFileReferenceNumber (16 bytes)
...
...
Usn
...
TimeStamp
...
Reason
SourceInfo
SecurityId
FileAttributes
FileNameLength																FileNameOffset
FileName (variable)
...

RecordLength (4 bytes): A 32-bit unsigned integer that contains the total length of the update sequence number (USN) record, in bytes.

MajorVersion (2 bytes): A 16-bit unsigned integer that contains the major version of the change journal software for this record. For a USN_RECORD_V3, the major version number is 3.

MinorVersion (2 bytes): A 16-bit unsigned integer that contains the minor version of the change journal software for this record. For a USN_RECORD_V3, the minor version number is 0 (zero).

FileReferenceNumber (16 bytes): The 128-bit file ID, as specified in section 2.1.10, of the file or directory for which this record notes changes.

ParentFileReferenceNumber (16 bytes): The 128-bit file ID, as specified in section 2.1.10, of the directory on which the file or directory that is associated with this record is located.

The fields Usn, TimeStamp, Reason, SourceInfo, SecurityId, FileAttributes, FileNameLength, FileNameOffset, and FileName for a USN RECORD_V3 element are as described for a USN_RECORD_V2 element; see section 2.3.62.2.