I'm reading my drive c journal and I already got the files i wanted but the problem is I can't access the files because FSCTL_READ_USN_JOURNAL can only output some info and the useful one should be the parentreferencenumber.
Is there a way to the fullpath of a file using ParentReferenceNumber?