We claim:
1. A system, comprising: a processor programmed with a file stream scanning module to: parse, during a current filesystem check, a sparse file stream comprising a plurality of Update Sequence Numbers (USNs), each USN having a respective byte offset from a beginning 5 of the sparse file stream and identifying a file in the filesystem associated with a file event, wherein each time the file is added or modified, the USN for the file is incremented to indicate that a change has occurred; access a checkpoint USN that is locally stored apart from the sparse file stream and serves as a checkpoint of a prior USN that was accessed during a prior filesystem check; 10 identify a next byte offset for a next USN of a file in the sparse file stream after the checkpoint USN based on the byte offset of the checkpoint USN; update the checkpoint USN with the next USN; identify a file event from the sparse file stream based on the next USN without polling files or directories on the filesystem; and 15
pass the file event to a downstream system.
2. The system of claim 1, wherein to identify the file event, the processor is further programmed to: decode a bitwise-encoded field that encodes a type of file event from the sparse file 20 stream.
3. The system of claim 1, wherein the processor is further programmed to: identify a file path of a file corresponding to the next USN; and
pass the file path to the downstream system.
4. The system of claim 3, wherein to identify the file path, the processor is further 5 programmed to: identify the file path from a Master File Table (MFT) based on the next USN.
5. The system of claim 4, wherein the processor is further programmed to: generate a file reference map based on a file reference and the file path from the MFT. 10
6. The system of claim 5, wherein the file reference is a string value, and wherein the processor is further programmed to: generate the file reference based on conversion of a hexadecimal value of a se