Microsoft-Windows-BitLocker-Driver-Performance

Event	Title	Channel	Sample	Rule
1	fve:ReadRequest	Operational	Y	N
2	fve:ReadRequest	Operational	Y	N
3	fve:WriteRequest	Operational	Y	N
4	fve:WriteRequest	Operational	Y	N
5	fve:ReadSubRequest	Operational	N	N
6	fve:WriteSubRequest	Operational	N	N
7	fve:ReadSubRequestStart	Operational	N	N
8	fve:ReadSubRequestStop	Operational	N	N
9	fve:WriteSubRequestStart	Operational	N	N
10	fve:WriteSubRequestStop	Operational	N	N
11	fve:VolumeStackCreate	Operational	N	N
12	fve:VolumeStackDelete	Operational	N	N
13	fve:VolumeDiscoveryStart	Operational	N	N
14	fve:VolumeDiscoveryStop	Operational	N	N
15	fve:MetadataWriteStart	Operational	N	N
16	fve:MetadataWriteStop	Operational	N	N
17	fve:FveIoctlStart	Operational	N	N
18	fve:FveIoctlStop	Operational	N	N
19	fve:FveActionStart	Operational	N	N
20	fve:FveActionStop	Operational	N	N
21	fve:ConversionStart	Operational	N	N
22	fve:ConversionStop	Operational	N	N
23	fve:ConversionStepStart	Operational	N	N
24	fve:ConversionStepStop	Operational	N	N
25	fve:SliderMoveStart	Operational	N	N
26	fve:SliderMoveStop	Operational	N	N
27	fve:IoDecryptRequestStart	Operational	N	N
28	fve:IoDecryptRequestStop	Operational	N	N
29	fve:IoEncryptRequestStart	Operational	N	N
30	fve:IoEncryptRequestStop	Operational	N	N
31	fve:BCryptEncryptRequestStart	Operational	N	N
32	fve:BCryptEncryptRequestStop	Operational	N	N
33	fve:BCryptDecryptRequestStart	Operational	N	N
34	fve:BCryptDecryptRequestStop	Operational	N	N
35	fve:BCryptEncryptRequestStart35	Operational	N	N
36	fve:BCryptEncryptRequestStop36	Operational	N	N
37	fve:BCryptEncryptRequestStart37	Operational	N	N
38	fve:BCryptEncryptRequestStop38	Operational	N	N
39	fve:BCryptDecryptRequestStart39	Operational	N	N
40	fve:BCryptDecryptRequestStop40	Operational	N	N
41	fve:BCryptDecryptRequestStart41	Operational	N	N
42	fve:BCryptDecryptRequestStop42	Operational	N	N
43	fve:BCryptEncryptRequestStart43	Operational	N	N
44	fve:BCryptEncryptRequestStop44	Operational	N	N
45	fve:BCryptDecryptRequestStart45	Operational	N	N
46	fve:BCryptDecryptRequestStop46	Operational	N	N

Event ID 1: fve:ReadRequest

Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: fve:ReadRequest
Opcode: Start

Fields #

Name	Description
`DevObjPtr` Pointer
`IrpPtr` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-BitLocker-Driver-Performance",
    "guid": "{1DE130E1-C026-4CBF-BA0F-AB608E40AEEA}",
    "event_source_name": "",
    "event_id": 1,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 1,
    "keywords": "0x0000000000000020",
    "time_created": "2026-06-02T05:41:26.365+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3756,
      "thread_id": 15096
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "DevObjPtr": "0xFFFFBD09E2D09030",
    "IrpPtr": "0xFFFFBD09F3553010"
  },
  "message": "fve:ReadRequest"
}

Event ID 2: fve:ReadRequest

Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: fve:ReadRequest
Opcode: Stop

Fields #

Name	Description
`DevObjPtr` Pointer
`IrpPtr` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-BitLocker-Driver-Performance",
    "guid": "{1DE130E1-C026-4CBF-BA0F-AB608E40AEEA}",
    "event_source_name": "",
    "event_id": 2,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 2,
    "keywords": "0x0000000000000020",
    "time_created": "2026-06-02T05:41:26.366+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 10660,
      "thread_id": 13648
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "DevObjPtr": "0xFFFFBD09E2D09030",
    "IrpPtr": "0xFFFFBD09F3553010"
  },
  "message": "fve:ReadRequest"
}

Event ID 3: fve:WriteRequest

Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: fve:WriteRequest
Opcode: Start

Fields #

Name	Description
`DevObjPtr` Pointer
`IrpPtr` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-BitLocker-Driver-Performance",
    "guid": "{1DE130E1-C026-4CBF-BA0F-AB608E40AEEA}",
    "event_source_name": "",
    "event_id": 3,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 1,
    "keywords": "0x0000000000000020",
    "time_created": "2026-06-02T05:41:25.566+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 1496
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "DevObjPtr": "0xFFFFBD09E2D09030",
    "IrpPtr": "0xFFFFBD09F2E7F520"
  },
  "message": "fve:WriteRequest"
}

Event ID 4: fve:WriteRequest

Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: fve:WriteRequest
Opcode: Stop

Fields #

Name	Description
`DevObjPtr` Pointer
`IrpPtr` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-BitLocker-Driver-Performance",
    "guid": "{1DE130E1-C026-4CBF-BA0F-AB608E40AEEA}",
    "event_source_name": "",
    "event_id": 4,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 2,
    "keywords": "0x0000000000000020",
    "time_created": "2026-06-02T05:41:25.567+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 14172,
      "thread_id": 6176
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "DevObjPtr": "0xFFFFBD09E2D09030",
    "IrpPtr": "0xFFFFBD09F2E7F520"
  },
  "message": "fve:WriteRequest"
}

Event ID 5: fve:ReadSubRequest

Channel: Operational
Task: fve:ReadSubRequest

Fields #

Name	Description
`DevObjPtr` Pointer
`IrpPtr` Pointer
`SubIrpPtr` Pointer

Event ID 6: fve:WriteSubRequest

Channel: Operational
Task: fve:WriteSubRequest

Fields #

Name	Description
`DevObjPtr` Pointer
`IrpPtr` Pointer
`SubIrpPtr` Pointer

Event ID 7: fve:ReadSubRequestStart

Channel: Operational
Task: fve:ReadSubRequest
Opcode: Start

Fields #

Name	Description
`DevObjPtr` Pointer
`IrpPtr` Pointer

Event ID 8: fve:ReadSubRequestStop

Channel: Operational
Task: fve:ReadSubRequest
Opcode: Stop

Fields #

Name	Description
`DevObjPtr` Pointer
`IrpPtr` Pointer

Event ID 9: fve:WriteSubRequestStart

Channel: Operational
Task: fve:WriteSubRequest
Opcode: Start

Fields #

Name	Description
`DevObjPtr` Pointer
`IrpPtr` Pointer

Event ID 10: fve:WriteSubRequestStop

Channel: Operational
Task: fve:WriteSubRequest
Opcode: Stop

Fields #

Name	Description
`DevObjPtr` Pointer
`IrpPtr` Pointer

Event ID 11: fve:VolumeStackCreate

Channel: Operational
Task: fve:VolumeStackCreate

Fields #

Name	Description
`DevObjPtr` Pointer
`PdoPtr` Pointer

Event ID 12: fve:VolumeStackDelete

Channel: Operational
Task: fve:VolumeStackDelete

Fields #

Name	Description
`DevObjPtr` Pointer
`PdoPtr` Pointer

Event ID 13: fve:VolumeDiscoveryStart

Channel: Operational
Task: fve:VolumeDiscovery
Opcode: Start

Fields #

Name	Description
`DevObjPtr` Pointer

Event ID 14: fve:VolumeDiscoveryStop

Channel: Operational
Task: fve:VolumeDiscovery
Opcode: Stop

Fields #

Name	Description
`DevObjPtr` Pointer

Event ID 15: fve:MetadataWriteStart

Channel: Operational
Task: fve:MetadataWrite
Opcode: Start

Fields #

Name	Description
`DevObjPtr` Pointer
`Index` UInt32
`Offset` UInt64

Event ID 16: fve:MetadataWriteStop

Channel: Operational
Task: fve:MetadataWrite
Opcode: Stop

Fields #

Name	Description
`DevObjPtr` Pointer
`Index` UInt32
`Offset` UInt64

Event ID 17: fve:FveIoctlStart

Channel: Operational
Task: fve:FveIoctl
Opcode: Start

Fields #

Name	Description
`DevObjPtr` Pointer
`Command` UInt32

Event ID 18: fve:FveIoctlStop

Channel: Operational
Task: fve:FveIoctl
Opcode: Stop

Fields #

Name	Description
`DevObjPtr` Pointer
`Command` UInt32

Event ID 19: fve:FveActionStart

Channel: Operational
Task: fve:FveAction
Opcode: Start

Fields #

Name	Description
`DevObjPtr` Pointer
`Command` UInt32

Event ID 20: fve:FveActionStop

Channel: Operational
Task: fve:FveAction
Opcode: Stop

Fields #

Name	Description
`DevObjPtr` Pointer
`Command` UInt32

Event ID 21: fve:ConversionStart

Channel: Operational
Task: fve:Conversion
Opcode: Start

Fields #

Name	Description
`DevObjPtr` Pointer
`Command` UInt32

Event ID 22: fve:ConversionStop

Channel: Operational
Task: fve:Conversion
Opcode: Stop

Fields #

Name	Description
`DevObjPtr` Pointer
`Command` UInt32

Event ID 23: fve:ConversionStepStart

Channel: Operational
Task: fve:ConversionStep
Opcode: Start

Fields #

Name	Description
`DevObjPtr` Pointer
`Offset` UInt64
`Size` UInt32
`Command` UInt32

Event ID 24: fve:ConversionStepStop

Channel: Operational
Task: fve:ConversionStep
Opcode: Stop

Fields #

Name	Description
`DevObjPtr` Pointer
`Offset` UInt64
`Size` UInt32
`Command` UInt32

Event ID 25: fve:SliderMoveStart

Channel: Operational
Task: fve:SliderMove
Opcode: Start

Fields #

Name	Description
`DevObjPtr` Pointer
`PrevOffset` UInt64
`NextOffset` UInt64
`Size` UInt64

Event ID 26: fve:SliderMoveStop

Channel: Operational
Task: fve:SliderMove
Opcode: Stop

Fields #

Name	Description
`DevObjPtr` Pointer
`PrevOffset` UInt64
`NextOffset` UInt64
`Size` UInt64

Event ID 27: fve:IoDecryptRequestStart

Channel: Operational
Task: fve:IoDecryptRequest
Opcode: Start

Fields #

Name	Description
`DevObjPtr` Pointer
`SubIrpPtr` Pointer
`Offset` UInt64
`Size` UInt32

Event ID 28: fve:IoDecryptRequestStop

Channel: Operational
Task: fve:IoDecryptRequest
Opcode: Stop

Fields #

Name	Description
`DevObjPtr` Pointer
`SubIrpPtr` Pointer
`Offset` UInt64
`Size` UInt32

Event ID 29: fve:IoEncryptRequestStart

Channel: Operational
Task: fve:IoEncryptRequest
Opcode: Start

Fields #

Name	Description
`DevObjPtr` Pointer
`SubIrpPtr` Pointer
`Offset` UInt64
`Size` UInt32

Event ID 30: fve:IoEncryptRequestStop

Channel: Operational
Task: fve:IoEncryptRequest
Opcode: Stop

Fields #

Name	Description
`DevObjPtr` Pointer
`SubIrpPtr` Pointer
`Offset` UInt64
`Size` UInt32

Event ID 31: fve:BCryptEncryptRequestStart

Channel: Operational
Task: fve:BCryptEncryptRequest
Opcode: Start

Fields #

Name	Description
`BufferPtr` Pointer
`Size` UInt32

Event ID 32: fve:BCryptEncryptRequestStop

Channel: Operational
Task: fve:BCryptEncryptRequest
Opcode: Stop

Fields #

Name	Description
`BufferPtr` Pointer
`Size` UInt32

Event ID 33: fve:BCryptDecryptRequestStart

Channel: Operational
Task: fve:BCryptDecryptRequest
Opcode: Start

Fields #

Name	Description
`BufferPtr` Pointer
`Size` UInt32

Event ID 34: fve:BCryptDecryptRequestStop

Channel: Operational
Task: fve:BCryptDecryptRequest
Opcode: Stop

Fields #

Name	Description
`BufferPtr` Pointer
`Size` UInt32

Event ID 35: fve:BCryptEncryptRequestStart35

Channel: Operational
Task: fve:BCryptEncryptRequest
Opcode: Start

Fields #

Name	Description
`BufferPtr` Pointer
`Size` UInt32

Event ID 36: fve:BCryptEncryptRequestStop36

Channel: Operational
Task: fve:BCryptEncryptRequest
Opcode: Stop

Fields #

Name	Description
`BufferPtr` Pointer
`Size` UInt32

Event ID 37: fve:BCryptEncryptRequestStart37

Channel: Operational
Task: fve:BCryptEncryptRequest
Opcode: Start

Fields #

Name	Description
`BufferPtr` Pointer
`Size` UInt32

Event ID 38: fve:BCryptEncryptRequestStop38

Channel: Operational
Task: fve:BCryptEncryptRequest
Opcode: Stop

Fields #

Name	Description
`BufferPtr` Pointer
`Size` UInt32

Event ID 39: fve:BCryptDecryptRequestStart39

Channel: Operational
Task: fve:BCryptDecryptRequest
Opcode: Start

Fields #

Name	Description
`BufferPtr` Pointer
`Size` UInt32

Event ID 40: fve:BCryptDecryptRequestStop40

Channel: Operational
Task: fve:BCryptDecryptRequest
Opcode: Stop

Fields #

Name	Description
`BufferPtr` Pointer
`Size` UInt32

Event ID 41: fve:BCryptDecryptRequestStart41

Channel: Operational
Task: fve:BCryptDecryptRequest
Opcode: Start

Fields #

Name	Description
`BufferPtr` Pointer
`Size` UInt32

Event ID 42: fve:BCryptDecryptRequestStop42

Channel: Operational
Task: fve:BCryptDecryptRequest
Opcode: Stop

Fields #

Name	Description
`BufferPtr` Pointer
`Size` UInt32

Event ID 43: fve:BCryptEncryptRequestStart43

Channel: Operational
Task: fve:BCryptEncryptRequest
Opcode: Start

Fields #

Name	Description
`BufferPtr` Pointer
`Size` UInt32

Event ID 44: fve:BCryptEncryptRequestStop44

Channel: Operational
Task: fve:BCryptEncryptRequest
Opcode: Stop

Fields #

Name	Description
`BufferPtr` Pointer
`Size` UInt32

Event ID 45: fve:BCryptDecryptRequestStart45

Channel: Operational
Task: fve:BCryptDecryptRequest
Opcode: Start

Fields #

Name	Description
`BufferPtr` Pointer
`Size` UInt32

Event ID 46: fve:BCryptDecryptRequestStop46

Channel: Operational
Task: fve:BCryptDecryptRequest
Opcode: Stop

Fields #

Name	Description
`BufferPtr` Pointer
`Size` UInt32

Provenance

ETW provider GUID {1DE130E1-C026-4CBF-BA0F-AB608E40AEEA}

Defined in fvevol.sys, the binary that emits these events.

Win11-26200.6584, sample captured from a live trace, binary version 10.0.26100.4768, captured 2026-06-02 — Manifest XML pack, 2.0 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4768, captured 2026-06-02 — Manifest XML pack, 2.0 MB