I am trying to figure out how to read file system journal without admin privileges. To read the journal I need to call DeviceIoControl() Win32 function with FSCTL_READ_USN_JOURNAL code, which requires admin privileges.
However, I have discovered that OneDrive is able to read files that were deleted and moved even when OneDrive was not running. Here is what I did:
- Kill the OneDrive process, to make sure OneDrive is not running.
- Move or delete file(s) in the OneDrive folder.
- Start OneDrive. Moved and deleted files are properly moved and deleted on the server.
When I start OneDrive it does not request admin privileges and no UAC dialogs appear.
How OneDrive is capable to read the file system journal without admin privileges and any elevated right? Or is it possible to find moved and deleted files by any other means, without a file system journal?