Microsoft-Windows-FileHistory-Catalog

Event	Title	Channel	Sample	Rule
1	AttachStart	Debug	N	N
2	AttachStop	Debug	N	N
3	DetachStart	Debug	N	N
4	DetachStop	Debug	N	N
5	CreateStart	Debug	N	N
6	CreateStop	Debug	N	N
7	AddNamespaceRecordStart	Debug	N	N
8	AddNamespaceRecordStop	Debug	N	N
9	UpdateNamespaceRecordStart	Debug	N	N
10	UpdateNamespaceRecordStop	Debug	N	N
11	GetNamespaceRecordStart	Debug	N	N
12	GetNamespaceRecordStop	Debug	N	N
13	AddFileRecordStart	Debug	N	N
14	AddFileRecordStop	Debug	N	N
15	UpdateFileRecordStart	Debug	N	N
16	UpdateFileRecordStop	Debug	N	N
17	GetFileRecordStart	Debug	N	N
18	GetFileRecordStop	Debug	N	N
19	FindNsRecordsByFullPathStart	Debug	N	N
20	FindNsRecordsByFullPathStop	Debug	N	N
21	FindPointInTimeFolderStart	Debug	N	N
22	FindPointInTimeFolderStop	Debug	N	N
23	FindNsRecordsByFileRecordIdStart	Debug	N	N
24	FindNsRecordsByFileRecordIdStop	Debug	N	N
25	FindFileRecordsByStateStart	Debug	N	N
26	FindFileRecordsByStateStop	Debug	N	N
27	FindLibrariesTimelineStart	Debug	N	N
28	FindLibrariesTimelineStop	Debug	N	N
29	FindLibraryTimelineStart	Debug	N	N
30	FindLibraryTimelineStop	Debug	N	N
31	FindPointInTimeLibrariesStart	Debug	N	N
32	FindPointInTimeLibrariesStop	Debug	N	N
33	FindPointInTimeLibraryStart	Debug	N	N
34	FindPointInTimeLibraryStop	Debug	N	N
35	FindAllLibraryRecordsStart	Debug	N	N
36	FindAllLibraryRecordsStop	Debug	N	N
37	ReattachStart	Debug	N	N
38	ReattachStop	Debug	N	N
39	MoveNextStart	Debug	N	N
40	MoveNextStop	Debug	N	N
41	MovePreviousStart	Debug	N	N
42	MovePreviousStop	Debug	N	N
43	FindNsRecordsByTVisibleStart	Debug	N	N
44	FindNsRecordsByTVisibleStop	Debug	N	N

Event ID 1: AttachStart

Channel: Debug
Task: Attach
Opcode: Start

Fields #

Name	Description
`CatalogPath` UnicodeString
`CatalogPath2` UnicodeString
`ReadOnly` Int32

Event ID 2: AttachStop

Channel: Debug
Task: Attach
Opcode: Stop

Fields #

Name	Description
`CatalogPath` UnicodeString
`CatalogPath2` UnicodeString
`ReadOnly` Int32

Event ID 3: DetachStart

Channel: Debug
Task: Detach
Opcode: Start

Event ID 4: DetachStop

Channel: Debug
Task: Detach
Opcode: Stop

Event ID 5: CreateStart

Channel: Debug
Task: Create
Opcode: Start

Fields #

Name	Description
`CatalogPath` UnicodeString
`CatalogPath2` UnicodeString

Event ID 6: CreateStop

Channel: Debug
Task: Create
Opcode: Stop

Fields #

Name	Description
`CatalogPath` UnicodeString
`CatalogPath2` UnicodeString

Event ID 7: AddNamespaceRecordStart

Channel: Debug
Task: AddNamespaceRecord
Opcode: Start

Fields #

Name	Description
`Path` UnicodeString

Event ID 8: AddNamespaceRecordStop

Channel: Debug
Task: AddNamespaceRecord
Opcode: Stop

Fields #

Name	Description
`Path` UnicodeString

Event ID 9: UpdateNamespaceRecordStart

Channel: Debug
Task: UpdateNamespaceRecord
Opcode: Start

Fields #

Name	Description
`id` Int32
`Path` UnicodeString

Event ID 10: UpdateNamespaceRecordStop

Channel: Debug
Task: UpdateNamespaceRecord
Opcode: Stop

Fields #

Name	Description
`id` Int32
`Path` UnicodeString

Event ID 11: GetNamespaceRecordStart

Channel: Debug
Task: GetNamespaceRecord
Opcode: Start

Fields #

Name	Description
`id` Int32

Event ID 12: GetNamespaceRecordStop

Channel: Debug
Task: GetNamespaceRecord
Opcode: Stop

Fields #

Name	Description
`id` Int32

Event ID 13: AddFileRecordStart

Channel: Debug
Task: AddFileRecord
Opcode: Start

Fields #

Name	Description
`Path` UnicodeString

Event ID 14: AddFileRecordStop

Channel: Debug
Task: AddFileRecord
Opcode: Stop

Fields #

Name	Description
`Path` UnicodeString

Event ID 15: UpdateFileRecordStart

Channel: Debug
Task: UpdateFileRecord
Opcode: Start

Fields #

Name	Description
`id` Int32
`Path` UnicodeString

Event ID 16: UpdateFileRecordStop

Channel: Debug
Task: UpdateFileRecord
Opcode: Stop

Fields #

Name	Description
`id` Int32
`Path` UnicodeString

Event ID 17: GetFileRecordStart

Channel: Debug
Task: GetFileRecord
Opcode: Start

Fields #

Name	Description
`id` Int32

Event ID 18: GetFileRecordStop

Channel: Debug
Task: GetFileRecord
Opcode: Stop

Fields #

Name	Description
`id` Int32

Event ID 19: FindNsRecordsByFullPathStart

Channel: Debug
Task: FindNsRecordsByFullPath
Opcode: Start

Fields #

Name	Description
`Path` UnicodeString
`InitialPosition` Int32

Event ID 20: FindNsRecordsByFullPathStop

Channel: Debug
Task: FindNsRecordsByFullPath
Opcode: Stop

Fields #

Name	Description
`Path` UnicodeString
`InitialPosition` Int32

Event ID 21: FindPointInTimeFolderStart

Channel: Debug
Task: FindPointInTimeFolder
Opcode: Start

Fields #

Name	Description
`Path` UnicodeString
`BackupSetId` Int32

Event ID 22: FindPointInTimeFolderStop

Channel: Debug
Task: FindPointInTimeFolder
Opcode: Stop

Fields #

Name	Description
`Path` UnicodeString
`BackupSetId` Int32

Event ID 23: FindNsRecordsByFileRecordIdStart

Channel: Debug
Task: FindNsRecordsByFileRecordId
Opcode: Start

Fields #

Name	Description
`FileRecordId` Int32

Event ID 24: FindNsRecordsByFileRecordIdStop

Channel: Debug
Task: FindNsRecordsByFileRecordId
Opcode: Stop

Fields #

Name	Description
`FileRecordId` Int32

Event ID 25: FindFileRecordsByStateStart

Channel: Debug
Task: FindFileRecordsByState
Opcode: Start

Fields #

Name	Description
`State` Int32
`Sort` Int32

Event ID 26: FindFileRecordsByStateStop

Channel: Debug
Task: FindFileRecordsByState
Opcode: Stop

Fields #

Name	Description
`State` Int32
`Sort` Int32

Event ID 27: FindLibrariesTimelineStart

Channel: Debug
Task: FindLibrariesTimeline
Opcode: Start

Event ID 28: FindLibrariesTimelineStop

Channel: Debug
Task: FindLibrariesTimeline
Opcode: Stop

Event ID 29: FindLibraryTimelineStart

Channel: Debug
Task: FindLibraryTimeline
Opcode: Start

Fields #

Name	Description
`LibraryName` UnicodeString

Event ID 30: FindLibraryTimelineStop

Channel: Debug
Task: FindLibraryTimeline
Opcode: Stop

Fields #

Name	Description
`LibraryName` UnicodeString

Event ID 31: FindPointInTimeLibrariesStart

Channel: Debug
Task: FindPointInTimeLibraries
Opcode: Start

Fields #

Name	Description
`BackupSetId` Int32

Event ID 32: FindPointInTimeLibrariesStop

Channel: Debug
Task: FindPointInTimeLibraries
Opcode: Stop

Fields #

Name	Description
`BackupSetId` Int32

Event ID 33: FindPointInTimeLibraryStart

Channel: Debug
Task: FindPointInTimeLibrary
Opcode: Start

Fields #

Name	Description
`LibraryName` UnicodeString
`BackupSetId` Int32

Event ID 34: FindPointInTimeLibraryStop

Channel: Debug
Task: FindPointInTimeLibrary
Opcode: Stop

Fields #

Name	Description
`LibraryName` UnicodeString
`BackupSetId` Int32

Event ID 35: FindAllLibraryRecordsStart

Channel: Debug
Task: FindAllLibraryRecords
Opcode: Start

Event ID 36: FindAllLibraryRecordsStop

Channel: Debug
Task: FindAllLibraryRecords
Opcode: Stop

Event ID 37: ReattachStart

Channel: Debug
Task: Reattach
Opcode: Start

Event ID 38: ReattachStop

Channel: Debug
Task: Reattach
Opcode: Stop

Event ID 39: MoveNextStart

Channel: Debug
Task: MoveNext
Opcode: Start

Fields #

Name	Description
`IteratorName` UnicodeString

Event ID 40: MoveNextStop

Channel: Debug
Task: MoveNext
Opcode: Stop

Fields #

Name	Description
`IteratorName` UnicodeString

Event ID 41: MovePreviousStart

Channel: Debug
Task: MovePrevious
Opcode: Start

Fields #

Name	Description
`IteratorName` UnicodeString

Event ID 42: MovePreviousStop

Channel: Debug
Task: MovePrevious
Opcode: Stop

Fields #

Name	Description
`IteratorName` UnicodeString

Event ID 43: FindNsRecordsByTVisibleStart

Channel: Debug
Task: FindNsRecordsByTVisible
Opcode: Start

Fields #

Name	Description
`BackupSetId` Int32

Event ID 44: FindNsRecordsByTVisibleStop

Channel: Debug
Task: FindNsRecordsByTVisible
Opcode: Stop

Fields #

Name	Description
`BackupSetId` Int32

Provenance

ETW provider GUID b447b4dc-7780-11e0-ada3-18a90531a85a

Defined in fhsvc.dll, which carries the event manifest.

Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB