Não estou encontrando muita documentação para USN + ntfs-3g, mas procurando nas fontes ntfs-3g, em include / ntfs-3g /layout.h , encontrei o seguinte:
/**
* struct NTFS_RECORD -
*
* The Update Sequence Array (usa) is an array of the u16 values which belong
* to the end of each sector protected by the update sequence record in which
* this array is contained. Note that the first entry is the Update Sequence
* Number (usn), a cyclic counter of how many times the protected record has
* been written to disk. The values 0 and -1 (ie. 0xffff) are not used. All
* last u16's of each sector have to be equal to the usn (during reading) or
* are set to it (during writing). If they are not, an incomplete multi sector
* transfer has occurred when the data was written.
* The maximum size for the update sequence array is fixed to:
* maximum size = usa_ofs + (usa_count * 2) = 510 bytes
* The 510 bytes comes from the fact that the last u16 in the array has to
* (obviously) finish before the last u16 of the first 512-byte sector.
* This formula can be used as a consistency check in that usa_ofs +
* (usa_count * 2) has to be less than or equal to 510.
*/
typedef struct {
NTFS_RECORD_TYPES magic;/* A four-byte magic identifying the
record type and/or status. */
u16 usa_ofs; /* Offset to the Update Sequence Array (usa)
from the start of the ntfs record. */
u16 usa_count; /* Number of u16 sized entries in the usa
including the Update Sequence Number (usn),
thus the number of fixups is the usa_count
minus 1. */
} __attribute__((__packed__)) NTFS_RECORD;
(Veja também: campo usn do struct STANDARD_INFORMATION)
Então, aparentemente eles estão usando USNs, mas eu não sei o jeito certo de chegar até eles. Eu começaria observando como o NTFS_RECORD é usado, e tentaria trabalhar da API.