Microsoft-Windows-NtfsLog_cdac24ce683a371108c05bb363714355
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 10 | Event ID 10 | Operational | N | N |
| 11 | Event ID 11 | Operational | N | N |
| 12 | Event ID 12 | Operational | N | N |
| 13 | Event ID 13 | Operational | N | N |
| 14 | Event ID 14 | Operational | N | N |
| 15 | Event ID 15 | Operational | N | N |
| 16 | Event ID 16 | Operational | N | N |
| 17 | Event ID 17 | Operational | N | N |
| 18 | Event ID 18 | Operational | N | N |
| 19 | Event ID 19 | Operational | N | N |
| 20 | Event ID 20 | Operational | N | N |
| 21 | Event ID 21 | Operational | N | N |
| 22 | Event ID 22 | Operational | N | N |
| 23 | Event ID 23 | Operational | N | N |
| 24 | Event ID 24 | Operational | N | N |
| 25 | Event ID 25 | Operational | N | N |
| 26 | Event ID 26 | Operational | N | N |
| 27 | Event ID 27 | Operational | N | N |
| 28 | Event ID 28 | Operational | N | N |
| 29 | Event ID 29 | Operational | N | N |
| 30 | Event ID 30 | Operational | N | N |
| 31 | Event ID 31 | Operational | N | N |
| 32 | Event ID 32 | Operational | N | N |
| 33 | Event ID 33 | Operational | N | N |
| 34 | Event ID 34 | Operational | N | N |
| 35 | Event ID 35 | Operational | N | N |
| 36 | Event ID 36 | Operational | N | N |
| 37 | Event ID 37 | Operational | N | N |
| 38 | Event ID 38 | Operational | N | N |
| 39 | Event ID 39 | Operational | N | N |
| 40 | Event ID 40 | Operational | N | N |
| 41 | Event ID 41 | Operational | N | N |
| 42 | Event ID 42 | Operational | N | N |
| 43 | Event ID 43 | Operational | N | N |
| 44 | Event ID 44 | Operational | N | N |
| 45 | Event ID 45 | Operational | N | N |
| 46 | Event ID 46 | Operational | N | N |
| 47 | Event ID 47 | Operational | N | N |
| 48 | Event ID 48 | Operational | N | N |
| 49 | Event ID 49 | Operational | N | N |
| 50 | Event ID 50 | Operational | N | N |
| 51 | Event ID 51 | Operational | N | N |
| 52 | Event ID 52 | Operational | N | N |
| 53 | Event ID 53 | Operational | N | N |
| 54 | Event ID 54 | Operational | N | N |
| 55 | Event ID 55 | Operational | N | N |
| 56 | Event ID 56 | Operational | N | N |
| 57 | Event ID 57 | Operational | N | N |
| 58 | Event ID 58 | Operational | N | N |
| 59 | Event ID 59 | Operational | N | N |
| 60 | Event ID 60 | Operational | N | N |
| 61 | Event ID 61 | Operational | N | N |
| 62 | Event ID 62 | Operational | N | N |
| 63 | Event ID 63 | Operational | N | N |
| 64 | Event ID 64 | Operational | N | N |
| 65 | Event ID 65 | Operational | N | N |
| 66 | Event ID 66 | Operational | N | N |
| 67 | Event ID 67 | Operational | N | N |
| 68 | Event ID 68 | Operational | N | N |
| 69 | Event ID 69 | Operational | N | N |
| 70 | Event ID 70 | Operational | N | N |
| 71 | Event ID 71 | Operational | N | N |
| 72 | Event ID 72 | Operational | N | N |
| 73 | Event ID 73 | Operational | N | N |
| 74 | Event ID 74 | Operational | N | N |
| 75 | Event ID 75 | Operational | N | N |
| 76 | Event ID 76 | Operational | N | N |
| 77 | Event ID 77 | Operational | N | N |
| 78 | Event ID 78 | Operational | N | N |
| 79 | Event ID 79 | Operational | N | N |
| 80 | Event ID 80 | Operational | N | N |
| 81 | Event ID 81 | Operational | N | N |
| 82 | Event ID 82 | Operational | N | N |
| 83 | Event ID 83 | Operational | N | N |
| 84 | Event ID 84 | Operational | N | N |
| 85 | Event ID 85 | Operational | N | N |
| 86 | Event ID 86 | Operational | N | N |
| 87 | Event ID 87 | Operational | N | N |
| 88 | Event ID 88 | Operational | N | N |
| 89 | Event ID 89 | Operational | N | N |
| 90 | Event ID 90 | Operational | N | N |
| 91 | Event ID 91 | Operational | N | N |
| 92 | Event ID 92 | Operational | N | N |
| 93 | Event ID 93 | Operational | N | N |
| 94 | Event ID 94 | Operational | N | N |
| 95 | Event ID 95 | Operational | N | N |
| 96 | Event ID 96 | Operational | N | N |
| 97 | Event ID 97 | Operational | N | N |
| 98 | Event ID 98 | Operational | N | N |
| 99 | Event ID 99 | Operational | N | N |
| 100 | Event ID 100 | Operational | N | N |
| 101 | Event ID 101 | Operational | N | N |
| 102 | Event ID 102 | Operational | N | N |
| 103 | Event ID 103 | Operational | N | N |
| 104 | Event ID 104 | Operational | N | N |
| 105 | Event ID 105 | Operational | N | N |
| 106 | Event ID 106 | Operational | N | N |
| 107 | Event ID 107 | Operational | N | N |
| 108 | Event ID 108 | Operational | N | N |
| 109 | Event ID 109 | Operational | N | N |
Event ID 10
#Fields #
| Name | Description |
|---|---|
A10_Vcn HexInt64 | |
A11_AttributeFormNonresidentLowestVcn HexInt64 | |
A12_AttributeFormNonresidentHighestVcn HexInt64 | |
A13_AllocationClusters HexInt64 |
Event ID 12
#Fields #
| Name | Description |
|---|---|
A10_FileObject Pointer | |
A11_Scb Pointer | |
A12_StartingVcn HexInt64 | |
A13_ClusterCount HexInt64 | |
A14_Flags HexInt32 | |
A15_CcbForWriteExtend Pointer |
Event ID 13
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_FileObject Pointer | |
A12_Scb Pointer | |
A13_StartingVcn HexInt64 | |
A14_ClusterCount HexInt64 | |
A15_Flags HexInt32 | |
A16_CcbForWriteExtend Pointer |
Event ID 15
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_PurgeOffset HexInt64 | |
A12_PurgeChunkLength HexInt32 |
Event ID 16
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_LastVcn HexInt64 | |
A12_AttributeInstance HexInt32 |
Event ID 19
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_ValueLength HexInt32 | |
A12_AttributeFlags HexInt32 |
Event ID 20
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_LastVcn HexInt64 | |
A15_NewHighestVcn HexInt64 | |
A16_PassCount HexInt32 |
Event ID 21
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_ContextFoundAttributeAttributeFormNonresidentLowestVcn HexInt64 | |
A15_ContextFoundAttributeAttributeFormNonresidentHighestVcn HexInt64 | |
A16_ContextAttributeListEntryLowestVcn HexInt64 |
Event ID 22
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_ContextFoundAttributeAttributeFormNonresidentLowestVcn HexInt64 | |
A15_ContextFoundAttributeAttributeFormNonresidentHighestVcn HexInt64 | |
A16_ContextAttributeListEntryLowestVcn HexInt64 |
Event ID 23
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_ContextFoundAttributeAttributeFormNonresidentLowestVcn HexInt64 | |
A15_ContextFoundAttributeAttributeFormNonresidentHighestVcn HexInt64 | |
A16_ContextAttributeListEntryLowestVcn HexInt64 | |
A17_PassCount HexInt32 |
Event ID 24
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_ContextFoundAttributeAttributeFormNonresidentLowestVcn HexInt64 | |
A15_ContextFoundAttributeAttributeFormNonresidentHighestVcn HexInt64 | |
A16_ContextAttributeListEntryLowestVcn HexInt64 |
Event ID 25
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_NtfsFrsConsolidationStatisticsMergeSkipCount HexInt32 |
Event ID 26
#Fields #
| Name | Description |
|---|---|
A10_FileRecordSegmentNumberHighPart HexInt32 | |
A11_FileRecordSegmentNumberLowPart HexInt32 | |
A12_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 | |
A13_AttributeTypeCode HexInt32 |
Event ID 27
#Fields #
| Name | Description |
|---|---|
A10_FileRecordSegmentNumberHighPart HexInt32 | |
A11_FileRecordSegmentNumberLowPart HexInt32 | |
A12_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 | |
A13_AttributeTypeCode HexInt32 |
Event ID 28
#Fields #
| Name | Description |
|---|---|
A10_FcbVcb Pointer | |
A11_IrpContext Pointer | |
A12_PULONGLONG_FcbFileReference HexInt64 | |
A13_StdInfoAttrListEntrySignature HexInt32 | |
A14_StdInfoAttrListEntryLastCompactedSize HexInt32 | |
A15_CurrentAttributeListSize HexInt32 |
Event ID 29
#Fields #
| Name | Description |
|---|---|
A10_FcbVcb Pointer | |
A11_IrpContext Pointer | |
A12_PULONGLONG_FcbFileReference HexInt64 | |
A13_StdInfoAttrListEntrySignature HexInt32 | |
A14_StdInfoAttrListEntryLastCompactedSize HexInt32 | |
A15_NewStdInfoAttrListEntryLastCompactedSize HexInt32 |
Event ID 30
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_i HexInt32 | |
A12_MAX_MOVEABLE_ATTRIBUTES HexInt32 | |
A13_AttributeTypeCode HexInt32 | |
A14_AttributeRecordLength HexInt32 | |
A15_AttributeInstance HexInt32 |
Event ID 31
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_SizeNeeded HexInt32 | |
A12_AttributeTypeCode HexInt32 | |
A13_AttributeRecordLength HexInt32 | |
A14_AttributeFormCode HexInt32 | |
A15_AttributeInstance HexInt32 |
Event ID 32
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_SizeNeeded HexInt32 | |
A12_BytesToFree HexInt32 | |
A13_MappingPairSize HexInt32 | |
A14_NewMappingPairSize HexInt32 |
Event ID 33
#Fields #
| Name | Description |
|---|---|
A10_FileRecordSegmentNumberHighPart HexInt32 | |
A11_FileRecordSegmentNumberLowPart HexInt32 | |
A12_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 | |
A13_StartZero HexInt32 | |
A14_ZeroLength HexInt32 |
Event ID 34
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_ScbAttributeTypeCode HexInt32 | |
A15__ScbAttributeName CountedUtf16String | |
A16_NewStartVcn HexInt64 | |
A17_NewHalfWayVcn HexInt64 | |
A18_NewFinalVcn HexInt64 | |
A19_PackedMode HexInt32 | |
A20_TryPrior HexInt32 |
Event ID 35
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_ScbAttributeTypeCode HexInt32 | |
A15__ScbAttributeName CountedUtf16String | |
A16_FileRecordSequenceNumber HexInt32 | |
A17_FileRecordSegmentNumberLowPart HexInt32 | |
A18_NewStartVcn HexInt64 | |
A19_LastVcn HexInt64 | |
A20_NewFinalVcn HexInt64 |
Event ID 36
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_ScbAttributeTypeCode HexInt32 | |
A15__ScbAttributeName CountedUtf16String | |
A16_FileRecordSequenceNumber HexInt32 | |
A17_FileRecordSegmentNumberLowPart HexInt32 | |
A18_NewStartVcn HexInt64 | |
A19_LastVcn HexInt64 | |
A20_NewFinalVcn HexInt64 |
Event ID 37
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_NewFinalVcn HexInt64 |
Event ID 38
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_NewHalfWayVcn HexInt64 | |
A15_RangePtr Pointer |
Event ID 39
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_NewHalfWayVcn HexInt64 | |
A15_RangePtr Pointer |
Event ID 40
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_NtfsMcbArray Pointer | |
A15_NtfsMcbArrayStartingVcn HexInt64 | |
A16_NtfsMcbArrayEndingVcn HexInt64 |
Event ID 41
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_NtfsMcbArray Pointer | |
A15_NtfsMcbArrayStartingVcn HexInt64 | |
A16_NtfsMcbArrayEndingVcn HexInt64 |
Event ID 42
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_NtfsMcbArray Pointer | |
A15_NtfsMcbArrayStartingVcn HexInt64 | |
A16_NtfsMcbArrayEndingVcn HexInt64 |
Event ID 43
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_NtfsMcbArray Pointer | |
A15_NtfsMcbArrayStartingVcn HexInt64 | |
A16_NtfsMcbArrayEndingVcn HexInt64 |
Event ID 44
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_NewFinalVcnInMcb HexInt64 | |
A15_NewFinalVcn HexInt64 |
Event ID 45
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_NewStartVcn HexInt64 | |
A15_LastVcn HexInt64 | |
A16_NewFinalVcn HexInt64 | |
A17_NewFinalVcnInMcb HexInt64 | |
A18_NumberOfRanges HexInt32 | |
A19_DeletedNextAttribute HexInt32 | |
A20_Mcb1StartWithNewStartVcn HexInt32 | |
A21_Mcb1HoldNewStartVcn HexInt32 | |
A22_Mcb2StartWithNewStartVcn HexInt32 | |
A23_Mcb2HoldNewStartVcn HexInt32 | |
A24_McbArraySizeInUseChange Int32 |
Event ID 46
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_NewStartVcn HexInt64 | |
A15_DeletedNextAttributeNewFinalVcnInMcbLastVcn1 HexInt64 |
Event ID 47
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_LastVcn HexInt64 | |
A15_NewFinalVcnInMcb HexInt64 |
Event ID 48
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_ScbAttributeTypeCode HexInt32 | |
A15__ScbAttributeName CountedUtf16String | |
A16_PULONGLONG_ContextAttributeListEntrySegmentReference HexInt64 | |
A17_OldLowestVcn HexInt64 | |
A18_StartVcn HexInt64 | |
A19_NewAttributeInstance HexInt32 |
Event ID 49
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_ScbAttributeTypeCode HexInt32 | |
A15__ScbAttributeName CountedUtf16String | |
A16_OldLowestVcn HexInt64 | |
A17_StartVcn HexInt64 | |
A18_OldHighestVcn HexInt64 | |
A19_LastVcn HexInt64 | |
A20_FileRecordSequenceNumber HexInt32 | |
A21_FileRecordSegmentNumberLowPart HexInt32 |
Event ID 51
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14__VolumeId CountedUtf16String | |
A15_VcbVcbState HexInt32 |
Event ID 52
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_PULONGLONG_FcbFileReference HexInt64 | |
A14_AllFlagsFirstRequest HexInt32 |
Event ID 53
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_PULONGLONG_FcbFileReference HexInt64 |
Event ID 54
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_PULONGLONG_FcbFileReference HexInt64 |
Event ID 55
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_PULONGLONG_FcbFileReference HexInt64 | |
A14_FrsConsolidationContextRestartAttributeTypeCode HexInt32 | |
A15__FrsConsolidationContextRestartAttributeName CountedUtf16String | |
A16_FrsConsolidationContextRestartVcn HexInt64 | |
A17_FrsConsolidationContextRestartAttributeListEntryOffset HexInt32 | |
A18_AttributeListEntryOffset HexInt32 | |
A19_AttrContextAttributeListAttributeListFormNonresidentValidDataLength HexInt64 | |
A20_AttributeListGrowBy HexInt32 | |
A21_AttributeListGrowBy Int32 |
Event ID 56
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_PULONGLONG_FcbFileReference HexInt64 | |
A14_FrsConsolidationContextRestartAttributeTypeCode HexInt32 | |
A15__FrsConsolidationContextRestartAttributeName CountedUtf16String | |
A16_FrsConsolidationContextRestartVcn HexInt64 | |
A17_FrsConsolidationContextInstance HexInt32 | |
A18_FrsConsolidationContextRestartAttributeListEntryOffset HexInt32 | |
A19_AttrContextAttributeListAttributeListFormNonresidentValidDataLength HexInt64 |
Event ID 57
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_PULONGLONG_FcbFileReference HexInt64 | |
A14_FrsConsolidationContextRestartAttributeTypeCode HexInt32 | |
A15__FrsConsolidationContextRestartAttributeName CountedUtf16String | |
A16_FrsConsolidationContextRestartVcn HexInt64 | |
A17_FrsConsolidationContextInstance HexInt32 | |
A18_FrsConsolidationContextRestartAttributeListEntryOffset HexInt32 | |
A19_AttrContextAttributeListAttributeListFormNonresidentValidDataLength HexInt64 |
Event ID 60
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_PULONGLONG_FrsConsolidationContextFileReference HexInt64 | |
A13_IrpContextExceptionStatus HexInt32 |
Event ID 61
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_PULONGLONG_FcbFileReference HexInt64 |
Event ID 62
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_PULONGLONG_FcbFileReference HexInt64 |
Event ID 63
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_FileRef HexInt64 | |
A14_ExceptionStatus HexInt32 |
Event ID 64
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_FileRef HexInt64 | |
A14_RemovedFcb HexInt32 | |
A15_AllFlagsFcbAcquired HexInt32 | |
A16_IrpContextTransactionId HexInt32 |
Event ID 65
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_EndTimeQuadPart1000NtfsPerformanceFrequencyQuadPart Int64 | |
A13_FrsConsolidationContextTotalTime1000NtfsPerformanceFrequencyQuadPart Int64 |
Event ID 66
#Fields #
| Name | Description |
|---|---|
A10_FcbVcb Pointer | |
A11_IrpContext Pointer | |
A12_PULONGLONG_FcbFileReference HexInt64 | |
A13_StdInfoAttrListEntrySignature HexInt32 | |
A14_StdInfoAttrListEntryLastCompactedSize HexInt32 | |
A15_AttributeListSize HexInt32 |
Event ID 67
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12_Scb Pointer | |
A13__ScbMcb Pointer | |
A14_OriginalStartingVcn HexInt64 | |
A15_ClusterCount HexInt64 | |
A16_AllocateAll UInt32 | |
A17_TargetLcnNULLTargetLcnULONGLONG1 HexInt64 | |
A18_PreAllocated UInt32 | |
A19_UseDelayedAllocation UInt32 |
Event ID 68
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12_Scb Pointer | |
A13__ScbMcb Pointer | |
A14_OriginalStartingVcn HexInt64 | |
A15_ClusterCount HexInt64 | |
A16_AllocateAll UInt32 | |
A17_TargetLcnNULLTargetLcnULONGLONG1 HexInt64 | |
A18_PreAllocated UInt32 | |
A19_UseDelayedAllocation UInt32 |
Event ID 69
#Fields #
| Name | Description |
|---|---|
A10_FoundClusterCount HexInt64 | |
A11_Scb Pointer | |
A12_ScbTotalAllocated HexInt64 |
Event ID 70
#Fields #
| Name | Description |
|---|---|
A10_FoundClusterCount HexInt64 | |
A11_Scb Pointer | |
A12_ScbTotalAllocated HexInt64 | |
A13_ScbState HexInt32 | |
A14_IrpContextState2 HexInt32 | |
A15_AllocateWithNoHole Int32 |
Event ID 73
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12_Scb Pointer | |
A13__ScbMcb Pointer | |
A14_StartingVcn HexInt64 | |
A15_EndingVcn HexInt64 |
Event ID 74
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_PULONGLONG_ScbFcbFileReference HexInt64 | |
A12_StartingVcn HexInt64 | |
A13_EndingVcn HexInt64 |
Event ID 75
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12_Scb Pointer | |
A13__ScbMcb Pointer | |
A14_StartingVcn HexInt64 | |
A15_EndingVcn HexInt64 |
Event ID 76
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_PULONGLONG_ScbFcbFileReference HexInt64 | |
A12_AdjLcn HexInt64 | |
A13_AdjClusterCount HexInt64 |
Event ID 78
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_DeallocatedClusters Pointer | |
A12_DeallocatedClustersLsnQuadPart HexInt64 | |
A13_DeallocatedClustersClusterCount HexInt64 | |
A14_DeallocatedClustersFlags HexInt32 | |
A15_VcbDeallocatedClusters HexInt64 | |
A16_VcbDeallocatedClustersAdjClusterCount HexInt64 |
Event ID 79
#Fields #
| Name | Description |
|---|---|
A10_ClusterCount HexInt64 | |
A11_Scb Pointer | |
A12_TotalAllocated HexInt64 | |
A13_TotalAllocated Pointer |
Event ID 80
#Fields #
| Name | Description |
|---|---|
A10_ClusterCount HexInt64 | |
A11_Scb Pointer | |
A12_TotalAllocated Pointer | |
A13_ScbState HexInt32 | |
A14_IrpContextState2 HexInt32 |
Event ID 81
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_VcbDeallocatedClusters HexInt64 | |
A12_VcbDeallocatedClustersClustersRemoved HexInt64 |
Event ID 84
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12_FirstBit HexInt64 | |
A13_BeyondFinalBit HexInt64 | |
A14_RedoOperation HexInt32 | |
A15_UndoOperation HexInt32 |
Event ID 85
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11__Bitmap Pointer | |
A12_BaseLcn HexInt64 | |
A13_CurrentLcn HexInt64 |
Event ID 86
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12_StartingLcn HexInt64 | |
A13_ClusterCount HexInt64 |
Event ID 87
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11__Bitmap Pointer | |
A12_BaseLcn HexInt64 | |
A13_StartingLcn HexInt64 |
Event ID 88
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Bitmap Pointer | |
A12_BitMapOffset HexInt32 | |
A13_NumberOfBits HexInt32 |
Event ID 89
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12_StartingLcn HexInt64 | |
A13_ClusterCount HexInt64 |
Event ID 90
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11__Bitmap Pointer | |
A12_BaseLcn HexInt64 | |
A13_StartingLcn HexInt64 |
Event ID 91
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Bitmap Pointer | |
A12_BitMapOffset HexInt32 | |
A13_NumberOfBits HexInt32 |
Event ID 92
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12_Bitmap Pointer | |
A13_StartingBitmapLcn HexInt64 | |
A14_SetBits UInt32 |
Event ID 93
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Bitmap Pointer | |
A12_StartingBit HexInt64 | |
A13_EndingBit HexInt64 |
Event ID 95
#Fields #
| Name | Description |
|---|---|
A10_i HexInt32 | |
A11_OriginalSystemBitmapisizeofOriginalSystemBitmap0 HexInt32 |
Event ID 96
#Event ID 97
#Fields #
| Name | Description |
|---|---|
A10_Length Int64 | |
A11_BinIndex UInt32 | |
A12_Key UInt32 | |
A13_BitPosition Int32 | |
A14_GroupIndex Int32 | |
A15_GroupShiftFactor Int32 |
Event ID 100
#Fields #
| Name | Description |
|---|---|
A10_BinIndex UInt32 | |
A11_MaxLength Int64 | |
A12_GroupIndex Int32 | |
A13_RelativeBinIndex Int32 | |
A14_MaxKey UInt32 |
Event ID 101
#Fields #
| Name | Description |
|---|---|
A10_NtfsCachedRunBinGroupShift Int32 | |
A11_NtfsCachedRunBinGroupSize UInt32 | |
A12_NtfsCachedRunBinGroupMask HexInt32 |
Event ID 103
#Fields #
| Name | Description |
|---|---|
A10_StartingCluster HexInt64 | |
A11_ClusterCount HexInt64 | |
A12_VcbTotalClustersCommitted HexInt64 | |
A13_VcbTotalClusters HexInt64 | |
A14_VcbFreeClusters HexInt64 |
Event ID 104
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_FirstBitToClear HexInt32 | |
A12_BeyondLastBitToClear1 HexInt32 |
Event ID 106
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_FreeClusterBase1 HexInt64 | |
A12_FreeClusterCount1 HexInt64 |
Event ID 111
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_StartingZero HexInt64 | |
A12_ByteCount HexInt64 | |
A13_ExtentsDescriptor Pointer | |
A14_ExtentsDescriptorIndex Int32 | |
A15_ExtentsDescriptorStartOffset HexInt64 | |
A16_Offset HexInt64 | |
A17_MaxRuns Int32 |
Event ID 112
#Fields #
| Name | Description |
|---|---|
A10_RunIndex Int32 | |
A11_ExtentsDescriptorRunRunIndexBasePage HexInt64 | |
A12_ExtentsDescriptorRunRunIndexPageCount HexInt64 | |
A13_ExtentLength HexInt64 | |
A14_Offset HexInt64 | |
A15_RunIndexStartOffset HexInt64 |
Event ID 113
#Event ID 115
#Fields #
| Name | Description |
|---|---|
A10_StartingPhysicalAddrQuadPart HexInt64 | |
A11_LengthInExtent HexInt64 |
Event ID 116
#Fields #
| Name | Description |
|---|---|
A10_ExtentsDescriptorIndex Int32 | |
A11_ExtentsDescriptorStartOffset HexInt64 |
Event ID 117
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_StartingOffset HexInt64 | |
A12_BeyondEndOffset HexInt64 |
Event ID 118
#Fields #
| Name | Description |
|---|---|
A10_DataSetRangeIndex Int32 | |
A11_DsmBufferDataSetRangesDataSetRangeIndexStartingOffset HexInt64 | |
A12_DsmBufferDataSetRangesDataSetRangeIndexLengthInBytes HexInt64 |
Event ID 120
#Fields #
| Name | Description |
|---|---|
A10_DsmByteAddressRangesTotalNumberOfRanges Int32 | |
A11_DsmByteAddressRangesNumberOfRangesReturned Int32 |
Event ID 121
#Fields #
| Name | Description |
|---|---|
A10_Index Int32 | |
A11_DsmByteAddressRangesRangesIndexStartAddress HexInt64 | |
A12_DsmByteAddressRangesRangesIndexLengthInBytes HexInt64 |
Event ID 122
#Fields #
| Name | Description |
|---|---|
A10_StartingPhysicalAddrQuadPart HexInt64 | |
A11_LengthInExtent HexInt64 |
Event ID 123
#Fields #
| Name | Description |
|---|---|
A10_ExtentsDescriptorIndex Int32 | |
A11_ExtentsDescriptorStartOffset HexInt64 |
Event ID 124
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_StartingZero HexInt64 | |
A12_BeyondEndOffset HexInt64 | |
A13_ByteCount HexInt64 | |
A14_ExtentsDescriptor Pointer | |
A15_ExtentsDescriptorIndexExtentsDescriptorIndex0 Int32 | |
A16_ExtentsDescriptorStartOffsetExtentsDescriptorStartOffset0 HexInt64 |
Event ID 125
#Fields #
| Name | Description |
|---|---|
A10_ExtentsDescriptorIndex Int32 | |
A11_ExtentsDescriptorStartOffset HexInt64 |
Event ID 126
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Scb Pointer | |
A12_StartOffset HexInt64 | |
A13_ByteCount HexInt32 |
Event ID 132
#Fields #
| Name | Description |
|---|---|
A10_Irp Pointer | |
A11_IrpContext Pointer | |
A12_Vcb Pointer | |
A13_CreateContextFileObject Pointer | |
A14_CreateContextFileObjectRelatedFileObject Pointer | |
A15__CreateContextFileObjectFileName 25 | |
A16_CreateContextIrpSpParametersCreateOptions HexInt32 | |
A17_CreateContextIrpSpParametersCreateFileAttributes HexInt32 | |
A18_CreateContextDesiredAccess HexInt32 | |
A19_CreateContextIrpSpParametersCreateShareAccess HexInt32 | |
A20_CreateContextIrpSpParametersCreateEaLength HexInt32 |
Event ID 133
#Fields #
| Name | Description |
|---|---|
A10_Irp Pointer | |
A11_IrpContext Pointer | |
A12_Vcb Pointer | |
A13_CreateContextFileObject Pointer | |
A14_CreateContextFileObjectRelatedFileObject Pointer | |
A15__CreateContextFileObjectFileName CountedUtf16String | |
A16_CreateContextIrpSpParametersCreateOptions HexInt32 | |
A17_CreateContextIrpSpParametersCreateFileAttributes HexInt32 | |
A18_CreateContextDesiredAccess HexInt32 | |
A19_CreateContextIrpSpParametersCreateShareAccess HexInt32 | |
A20_CreateContextIrpSpParametersCreateEaLength HexInt32 |
Event ID 134
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbVcbState HexInt32 |
Event ID 136
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbVcbState HexInt32 |
Event ID 137
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_IrpSpParametersCreateShareAccess HexInt32 | |
A15_ReadULongNoFence_VcbCleanupCount Int32 | |
A16_BiasedCleanupCount Int32 |
Event ID 138
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbVcbState HexInt32 |
Event ID 139
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_IrpSpParametersCreateShareAccess HexInt32 | |
A15_VcbReadOnlyCloseCount Int32 | |
A16_VcbCloseCount Int32 | |
A17_VcbSystemFileCloseCount Int32 |
Event ID 140
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_FcbCleanupCount Int32 | |
A17_FcbFcbState HexInt32 | |
A18_IrpSpFlags HexInt32 |
Event ID 141
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_FcbFcbState HexInt32 | |
A17_IrpSpFlags HexInt32 |
Event ID 142
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_IrpContextState HexInt32 | |
A17_IrpSpFlags HexInt32 |
Event ID 143
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisFcbFcbState HexInt32 | |
A17_CreateContextIrpSpParametersCreateOptions24_0x000000ff HexInt32 | |
A18_CreateContextIrpSpParametersCreateSecurityContextDesiredAccess HexInt32 |
Event ID 144
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_CreateContextCurrentFcbVcb Pointer | |
A12__CreateContextCurrentFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWCreateContextCurrentFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHCreateContextCurrentFcbVcbVpb CountedUtf16String | |
A14_CreateContextCurrentFcb Pointer | |
A15_NtfsFullFileRefNumber_CreateContextCurrentFcbFileReference HexInt64 | |
A16_CreateContextCurrentFcbInfoFileAttributes HexInt32 | |
A17_CreateContextCurrentFcbTxfRmcbRmState HexInt32 |
Event ID 145
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_CreateContextCurrentFcbVcb Pointer | |
A12__CreateContextCurrentFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWCreateContextCurrentFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHCreateContextCurrentFcbVcbVpb CountedUtf16String | |
A14_CreateContextCurrentFcb Pointer | |
A15_NtfsFullFileRefNumber_CreateContextCurrentFcbFileReference HexInt64 | |
A16_CreateContextCurrentFcbFcbState HexInt32 | |
A17_CreateContextIrpSpParametersCreateOptions24_0x000000ff HexInt32 | |
A18_CreateContextIrpSpParametersCreateSecurityContextDesiredAccess HexInt32 |
Event ID 146
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisFcbFcbState HexInt32 |
Event ID 147
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisFcbFcbState HexInt32 | |
A17_CreateContextIrpSpParametersCreateOptions24_0x000000ff HexInt32 | |
A18_CreateContextIrpSpParametersCreateSecurityContextDesiredAccess HexInt32 |
Event ID 148
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisFcbTxfRmcbRmState HexInt32 |
Event ID 149
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ParentScbFcbVcb Pointer | |
A12__ParentScbFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWParentScbFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHParentScbFcbVcbVpb CountedUtf16String | |
A14_ParentScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ParentScbFcbFileReference HexInt64 | |
A16_ParentScbFcbFcbState HexInt32 | |
A17_ParentScbFcbTxfRmcbRmState HexInt32 | |
A18_AttrTypeCode HexInt32 |
Event ID 150
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_CreateContextIrpSpParametersCreateOptions HexInt32 | |
A17_CcbFlags HexInt32 |
Event ID 151
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ParentScbVcb Pointer | |
A12__ParentScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWParentScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHParentScbVcbVpb CountedUtf16String | |
A14_ParentScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ParentScbFcbFileReference HexInt64 | |
A16_ParentScbFcbFcbState HexInt32 | |
A17_ParentScbFcbTxfRmcbRmState HexInt32 |
Event ID 152
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisFcbTxfRmcbRmState HexInt32 |
Event ID 153
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisEaInformationNeedEaCount Int32 | |
A17_CreateContextIrpSpParametersCreateOptions HexInt32 | |
A18_CcbFlags HexInt32 |
Event ID 154
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_AttrTypeCode HexInt32 | |
A17_CreateDisposition HexInt32 |
Event ID 155
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_CreateDisposition HexInt32 |
Event ID 156
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisFcbFcbState HexInt32 | |
A17_AttrTypeCode HexInt32 |
Event ID 157
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisFcbInfoFileAttributes HexInt32 | |
A17_FileAttributes HexInt32 |
Event ID 158
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_CreateContextIrpSpParametersCreateOptions HexInt32 |
Event ID 159
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_CreateContextThisScbAttributeTypeCode HexInt32 | |
A17_CreateContextThisScbState HexInt32 | |
A18_CreateContextThisScbScbTypeDataHighWaterMark Int64 |
Event ID 160
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_AttrCode HexInt32 | |
A15_CreateDisposition HexInt32 |
Event ID 161
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_AttrCode HexInt32 | |
A15_IrpSpParametersCreateSecurityContextAccessStateOriginalDesiredAccess HexInt32 |
Event ID 163
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisScbVcb Pointer | |
A12__ThisScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisScbVcbVpb CountedUtf16String | |
A14_ThisScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisScbFcbFileReference HexInt64 | |
A16_ThisScb Pointer | |
A17_ThisScbAttributeTypeCode HexInt32 | |
A18__ThisScbAttributeName CountedUtf16String | |
A19_IrpSpParametersCreateShareAccess HexInt32 | |
A20_IrpSpParametersCreateSecurityContextAccessStatePreviouslyGrantedAccess HexInt32 |
Event ID 164
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisScbVcb Pointer | |
A12__ThisScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisScbVcbVpb CountedUtf16String | |
A14_ThisScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisScbFcbFileReference HexInt64 | |
A16_ThisScb Pointer | |
A17_ThisScbAttributeTypeCode HexInt32 | |
A18__ThisScbAttributeName CountedUtf16String |
Event ID 165
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisScbVcb Pointer | |
A12__ThisScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisScbVcbVpb CountedUtf16String | |
A14_ThisScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisScbFcbFileReference HexInt64 | |
A16_ThisScb Pointer | |
A17_ThisScbAttributeTypeCode HexInt32 | |
A18__ThisScbAttributeName CountedUtf16String | |
A19_IrpSpParametersCreateSecurityContextAccessStatePreviouslyGrantedAccess HexInt32 |
Event ID 166
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisScbVcb Pointer | |
A12__ThisScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisScbVcbVpb CountedUtf16String | |
A14_ThisScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisScbFcbFileReference HexInt64 | |
A16_ThisScb Pointer | |
A17_ThisScbMarkHandleDisallowWritesCount Int32 | |
A18_IrpSpParametersCreateSecurityContextDesiredAccess HexInt32 |
Event ID 167
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisScbVcb Pointer | |
A12__ThisScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisScbVcbVpb CountedUtf16String | |
A14_ThisScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisScbFcbFileReference HexInt64 | |
A16_ThisScb Pointer | |
A17_ThisScbAttributeTypeCode HexInt32 | |
A18__ThisScbAttributeName CountedUtf16String | |
A19_IrpSpParametersCreateShareAccess HexInt32 | |
A20_GrantedAccess HexInt32 |
Event ID 168
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisScbVcb Pointer | |
A12__ThisScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisScbVcbVpb CountedUtf16String | |
A14_ThisScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisScbFcbFileReference HexInt64 | |
A16_IrpSpParametersCreateShareAccess HexInt32 | |
A17_IrpSpFileObjectFlags HexInt32 |
Event ID 169
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisScbVcb Pointer | |
A12__ThisScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisScbVcbVpb CountedUtf16String | |
A14_ThisScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisScbFcbFileReference HexInt64 | |
A16_ThisScb Pointer | |
A17_ThisScbAttributeTypeCode HexInt32 | |
A18__ThisScbAttributeName CountedUtf16String | |
A19_IrpSpParametersCreateShareAccess HexInt32 | |
A20_GrantedAccess HexInt32 |
Event ID 170
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_IrpSpParametersCreateShareAccess HexInt32 | |
A17_IrpSpFileObjectFlags HexInt32 |
Event ID 171
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_IrpSpParametersCreateSecurityContextDesiredAccess HexInt32 | |
A17_ThisFcbInfoFileAttributes HexInt32 | |
A18_IrpSpFlags HexInt32 |
Event ID 172
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_CurrentFcbVcb Pointer | |
A12__CurrentFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWCurrentFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHCurrentFcbVcbVpb CountedUtf16String | |
A14_CurrentFcb Pointer | |
A15_NtfsFullFileRefNumber_CurrentFcbFileReference HexInt64 | |
A16_CurrentFcbInfoFileAttributes HexInt32 | |
A17_NtfsDataFlags HexInt32 |
Event ID 173
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_CurrentFcbVcb Pointer | |
A12__CurrentFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWCurrentFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHCurrentFcbVcbVpb CountedUtf16String | |
A14_CurrentFcb Pointer | |
A15_NtfsFullFileRefNumber_CurrentFcbFileReference HexInt64 | |
A16_CurrentFcbInfoFileAttributes HexInt32 | |
A17_ThisScbAttributeFlags HexInt32 |
Event ID 174
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisScbVcb Pointer | |
A12__ThisScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisScbVcbVpb CountedUtf16String | |
A14_ThisScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisScbFcbFileReference HexInt64 | |
A16_CreateContextCurrentFcbCleanupCount Int32 | |
A17_NtfsDataEncryptionCallBackTableImplementationFlags HexInt32 |
Event ID 175
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_CurrentFcb Pointer | |
A12_NtfsFullFileRefNumber_CurrentFcbFileReference HexInt64 | |
A13_CurrentFcbTxfRmcbRmState HexInt32 |
Event ID 176
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_LcbFcbVcb Pointer | |
A12__LcbFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWLcbFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHLcbFcbVcbVpb CountedUtf16String | |
A14_LcbFcb Pointer | |
A15_NtfsFullFileRefNumber_LcbFcbFileReference HexInt64 | |
A16_WppCountedStringWLcbFileNameAttrFileNameUSHORTLcbFileNameAttrFileNameLength CountedUtf16String | |
A17_DesiredAccess HexInt32 | |
A18_DesiredShareAccess HexInt32 | |
A19_IoShareAccessFlags HexInt32 | |
A20_LinkShareAccessOpenCount Int32 | |
A21_LinkShareAccessDeleters Int32 | |
A22_LinkShareAccessSharedDelete Int32 |
Event ID 177
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_ScbAttributeTypeCode HexInt32 | |
A17__ScbAttributeName CountedUtf16String | |
A18_DesiredAccess HexInt32 | |
A19_DesiredShareAccess HexInt32 | |
A20_IoShareAccessFlags HexInt32 | |
A21_ShareAccessOpenCount Int32 | |
A22_ShareAccessReaders Int32 | |
A23_ShareAccessWriters Int32 | |
A24_ShareAccessDeleters Int32 | |
A25_ShareAccessSharedRead Int32 | |
A26_ShareAccessSharedWrite Int32 | |
A27_ShareAccessSharedDelete Int32 |
Event ID 178
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_ScbAttributeTypeCode HexInt32 | |
A17__ScbAttributeName CountedUtf16String | |
A18_WppCountedStringWLcbFileNameAttrFileNameUSHORTLcbFileNameAttrFileNameLength CountedUtf16String | |
A19_DesiredAccess HexInt32 | |
A20_DesiredShareAccess HexInt32 | |
A21_IoShareAccessFlags HexInt32 | |
A22_ShareAccessOpenCount Int32 | |
A23_ShareAccessReaders Int32 | |
A24_ShareAccessWriters Int32 | |
A25_ShareAccessDeleters Int32 | |
A26_ShareAccessSharedRead Int32 | |
A27_ShareAccessSharedWrite Int32 | |
A28_ShareAccessSharedDelete Int32 | |
A29_LinkShareAccessOpenCount Int32 | |
A30_LinkShareAccessDeleters Int32 | |
A31_LinkShareAccessSharedDelete Int32 |
Event ID 179
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_ScbAttributeTypeCode HexInt32 | |
A17__ScbAttributeName CountedUtf16String | |
A18_ARGUMENT_PRESENTLcbWppCountedStringWLcbFileNameAttrFileNameUSHORTLcbFileNameAttrFileNameLengthWppCountedStringWNULL0 CountedUtf16String | |
A19_AccessStatePreviouslyGrantedAccess HexInt32 | |
A20_AccessStateFlags HexInt32 | |
A21_DesiredShareAccess HexInt32 | |
A22_CreateDisposition HexInt32 | |
A23_ScbShareAccessOpenCount Int32 | |
A24_ScbShareAccessReaders Int32 | |
A25_ScbShareAccessWriters Int32 | |
A26_ScbShareAccessDeleters Int32 | |
A27_ScbShareAccessSharedRead Int32 | |
A28_ARGUMENT_PRESENTLcbLcbLinkShareAccessDeleters0 Int32 |
Event ID 180
#Fields #
| Name | Description |
|---|---|
A10_FILEID_FROM_SOURCEFileNLine UInt32 | |
A11_LINENUM_FROM_SOURCEFileNLine Int32 | |
A12_Status HexInt32 | |
A13__ProcessName CountedMbcsString |
Event ID 181
#Fields #
| Name | Description |
|---|---|
A10_FILEID_FROM_SOURCEFileNLine UInt32 | |
A11_LINENUM_FROM_SOURCEFileNLine Int32 | |
A12_Status HexInt32 | |
A13__ProcessName CountedMbcsString |
Event ID 182
#Fields #
| Name | Description |
|---|---|
A10_FILEID_FROM_SOURCEFileNLine UInt32 | |
A11_LINENUM_FROM_SOURCEFileNLine Int32 | |
A12_Status HexInt32 | |
A13__ProcessName CountedMbcsString |
Event ID 183
#Fields #
| Name | Description |
|---|---|
A10_FILEID_FROM_SOURCEFileNLine UInt32 | |
A11_LINENUM_FROM_SOURCEFileNLine Int32 | |
A12_Status HexInt32 | |
A13__ProcessName CountedMbcsString |
Event ID 184
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_StartingCluster HexInt64 | |
A12_RunLength HexInt32 |
Event ID 186
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_MarkUnusedContext Pointer | |
A12_MarkUnusedContextDeallocatedClusters Pointer | |
A13__MarkUnusedContextDeallocatedClustersMcb Pointer |
Event ID 187
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_StartingCluster HexInt64 | |
A12_RunLength HexInt32 | |
A13__MarkUnusedContextDeallocatedClustersMcb Pointer |
Event ID 188
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11__MarkUnusedContextDeallocatedClustersMcb Pointer |
Event ID 189
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_MarkUnusedContext Pointer | |
A12_IrpContext Pointer |
Event ID 191
#Fields #
| Name | Description |
|---|---|
A10_Src Pointer | |
A11_Dst Pointer | |
A12_SrcClustersCount HexInt64 | |
A13_SrcDeallocatedClustersClusterCount HexInt64 | |
A14_SrcDsmAttrDataSetRangesLength HexInt32 |
Event ID 192
#Fields #
| Name | Description |
|---|---|
A10_Src Pointer | |
A11_Dst Pointer | |
A12_SrcClustersCount HexInt64 | |
A13_DstClustersCount HexInt64 | |
A14_DstDsmAttrDataSetRangesLength HexInt32 | |
A15_DstFirstDataSetRangePtrLengthInBytes HexInt64 | |
A16_DstFirstDataSetRangePtrStartingOffset HexInt64 |
Event ID 193
#Event ID 194
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_MarkUnusedContext Pointer | |
A12_VcbDeallocatedClusters HexInt64 | |
A13_VcbDeallocatedClustersListLengthInTrim HexInt32 | |
A14_VcbDeallocatedClustersListLengthToDrain HexInt32 | |
A15_ClustersClusterCount HexInt64 | |
A16_InitialRanges HexInt32 |
Event ID 195
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_MarkUnusedContext Pointer | |
A12_StartingLcn HexInt64 | |
A13_ClusterCount HexInt64 | |
A14_FreeClusterBase1 HexInt64 | |
A15_FreeClusterCount1 HexInt64 | |
A16_FreeClusterBase2 HexInt64 | |
A17_FreeClusterCount2 HexInt64 |
Event ID 198
#Event ID 204
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_SmallMarkUnusedContext Pointer | |
A12_MarkUnusedContext Pointer |
Event ID 212
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_Status HexInt32 | |
A12_MarkUnusedContext Pointer | |
A13_MarkUnusedContextNULL__MarkUnusedContextDeallocatedClustersNULLMarkUnusedContextDeallocatedClustersClusterCount1LL HexInt64 |
Event ID 213
#Event ID 222
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_DeallocatedClustersToWaitForDeallocatedClusters Pointer |
Event ID 224
#Fields #
| Name | Description |
|---|---|
A10_IrpContextVcb Pointer | |
A11_DeallocatedClustersToWaitForDeallocatedClusters Pointer |
Event ID 225
#Fields #
| Name | Description |
|---|---|
A10_WaitInSeconds Int32 | |
A11_CurrentTimeQuadPartDeallocatedClustersToWaitForEndTimeQuadPartULONGCurrentTimeQuadPartDeallocatedClustersToWaitForEndTimeQuadPartNtfsDataSystemTimeIncrementINTERVAL_ONE_SECOND0 Int32 | |
A12_IrpContext Pointer | |
A13_IrpContextVcb Pointer | |
A14_DeallocatedClusters Pointer |
Event ID 226
#Fields #
| Name | Description |
|---|---|
A10_WaitInSeconds Int32 | |
A11_CurrentTimeQuadPartDeallocatedClustersToWaitForEndTimeQuadPartULONGCurrentTimeQuadPartDeallocatedClustersToWaitForEndTimeQuadPartNtfsDataSystemTimeIncrementINTERVAL_ONE_SECOND0 Int32 | |
A12_IrpContext Pointer | |
A13_IrpContextVcb Pointer | |
A14_DeallocatedClusters Pointer |
Event ID 232
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_MarkUnusedContext Pointer | |
A12_RunIndex UInt32 | |
A13_StartingOffset HexInt64 | |
A14_LengthInBytes HexInt64 |
Event ID 233
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_MarkUnusedContext Pointer | |
A12_DataSetRangeCount UInt32 | |
A13_McbRunCount UInt32 | |
A14_SmartTrimFreeRangeCount UInt32 |
Event ID 234
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_MarkUnusedContext Pointer | |
A12_RunIndex UInt32 | |
A13_DataSetRangeStartingOffset HexInt64 | |
A14_DataSetRangeLengthInBytes HexInt64 |
Event ID 235
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_StartingLcn HexInt64 | |
A12_ClusterCount HexInt64 | |
A13_FirstTpMapBit HexInt32 | |
A14_LastTpMapBit HexInt32 |
Event ID 237
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_SlabRangeIndex UInt32 | |
A12_SlabRangeFirstTPMapBit HexInt32 | |
A13_SlabRangeLastTPMapBit HexInt32 |
Event ID 244
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_TpMapBit HexInt32 | |
A12_SlabBaseLcn HexInt64 | |
A13_SlabLengthInClusters HexInt64 |
Event ID 248
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbVcbState HexInt32 | |
A15_IrpSpFlags HexInt32 |
Event ID 249
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Status HexInt32 |
Event ID 250
#Event ID 251
#Event ID 252
#Event ID 253
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_StartingVbo HexInt64 | |
A12_ByteCount HexInt32 |
Event ID 255
#Fields #
| Name | Description |
|---|---|
A10_ULONGBadVcn HexInt32 | |
A11_PLARGE_INTEGER_BadVcnHighPart HexInt32 |
Event ID 256
#Fields #
| Name | Description |
|---|---|
A10_ULONGBadLcn HexInt32 | |
A11_PLARGE_INTEGER_BadLcnHighPart HexInt32 |
Event ID 257
#Event ID 258
#Event ID 260
#Fields #
| Name | Description |
|---|---|
A10_NewBufferSize HexInt32 | |
A11_NtfsGetCompressionBufferSize HexInt32 |
Event ID 265
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_ScbPersist HexInt32 | |
A20_CcbFlags HexInt32 |
Event ID 268
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_ScbPersist HexInt32 | |
A20_CcbFlags HexInt32 |
Event ID 269
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A14_MoveDataStartingVcnQuadPart HexInt64 | |
A15_TransferClusters HexInt64 | |
A16_Lcn HexInt64 | |
A17_MoveDataStartingLcnQuadPart HexInt64 | |
A18_CopyLength HexInt32 | |
A19_FlagsUseDelayedAllocation Int32 | |
A20_Status HexInt32 |
Event ID 270
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A14_MoveDataStartingVcnQuadPart HexInt64 | |
A15_TransferClusters HexInt64 | |
A16_Lcn HexInt64 | |
A17_MoveDataStartingLcnQuadPart HexInt64 | |
A18_CopyLength HexInt32 | |
A19_FlagsUseDelayedAllocation Int32 | |
A20_MyStatus HexInt32 |
Event ID 271
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A14_Lcn HexInt64 | |
A15_CopyLength HexInt32 | |
A16_MyStatus HexInt32 |
Event ID 272
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A14_MoveDataStartingLcnQuadPart HexInt64 | |
A15_CopyLength HexInt32 | |
A16_MyStatus HexInt32 |
Event ID 273
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A14_MoveDataStartingVcnQuadPart HexInt64 | |
A15_TransferClusters HexInt64 | |
A16_Lcn HexInt64 | |
A17_MoveDataStartingLcnQuadPart HexInt64 | |
A18_FlagsUseDelayedAllocation Int32 | |
A19_ValidClusters HexInt64 |
Event ID 274
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A14_MoveDataStartingVcnQuadPart HexInt64 | |
A15_TransferClusters HexInt64 |
Event ID 275
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_FcbNULLNtfsFullFileRefNumber_FcbFileReference0 HexInt64 | |
A16_CcbNULLCcbFlags0 HexInt32 |
Event ID 276
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18_ScbAttributeNameBuffer UnicodeString | |
A19_ScbPersist HexInt32 | |
A20_CcbFlags HexInt32 |
Event ID 279
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_ScbPersist HexInt32 | |
A20_CcbNULLCcbFlags0 HexInt32 |
Event ID 280
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_ScbHeaderValidDataLengthQuadPart HexInt64 | |
A12_ScbHeaderFileSizeQuadPart HexInt64 | |
A13_QueryDaxExtentsFileOffset HexInt64 | |
A14_StartingVcn HexInt64 | |
A15_QueryDaxExtentsLength HexInt64 |
Event ID 281
#Fields #
| Name | Description |
|---|---|
A10_QueryDaxExtentsFileOffset HexInt64 | |
A11_QueryDaxExtentsLength HexInt64 | |
A12_EffectiveInputFileRegionLength HexInt64 | |
A13_StartingVcn HexInt64 | |
A14_BeyondEndVcn HexInt64 | |
A15_RemainingClusterCount HexInt64 | |
A16_LastVcnInFile HexInt64 |
Event ID 282
#Event ID 283
#Fields #
| Name | Description |
|---|---|
A10_RemainingClusterCount HexInt64 | |
A11_DataSetRangeIndex Int32 | |
A12_OutputBufferLength Int32 |
Event ID 284
#Fields #
| Name | Description |
|---|---|
A10_ExtentsDescriptorNumberOfValidRuns HexInt32 | |
A11_MaxRuns HexInt32 | |
A12_BytesReturned HexInt64 |
Event ID 285
#Fields #
| Name | Description |
|---|---|
A10_RemainingClusterCount HexInt64 | |
A11_ExtentsDescriptorNumberOfValidRuns HexInt32 |
Event ID 286
#Fields #
| Name | Description |
|---|---|
A10_RemainingClusterCount HexInt64 | |
A11_ExtentsDescriptorNumberOfValidRuns HexInt32 |
Event ID 287
#Fields #
| Name | Description |
|---|---|
A10_ExtentsDescriptorNumberOfValidRuns HexInt32 | |
A11_MaxRuns HexInt32 | |
A12_Status HexInt32 | |
A13_BytesReturned HexInt64 |
Event ID 288
#Fields #
| Name | Description |
|---|---|
A10_ExtentsDescriptorRunIndexBasePage HexInt64 | |
A11_ExtentsDescriptorRunIndexPageCount HexInt64 |
Event ID 291
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_CcbFlags HexInt32 |
Event ID 292
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_ARGUMENT_PRESENTCcbCcbAccessFlags0 HexInt32 | |
A20_ARGUMENT_PRESENTCreateContextCreateContextPreviouslyGrantedAccess0 HexInt32 |
Event ID 293
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_CcbFlags HexInt32 |
Event ID 294
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_CcbNULLCcbFlags0 HexInt32 |
Event ID 295
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_ScbVcbVpbRealDeviceFlags HexInt32 |
Event ID 296
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_RenameCleanupTargetLinkFcb Pointer | |
A15_NtfsFullFileRefNumber_RenameCleanupTargetLinkFcbFileReference HexInt64 | |
A16_RenameCleanupTargetLinkFcbFcbState HexInt32 |
Event ID 297
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_RenameCleanupTargetLinkFcb Pointer | |
A15_NtfsFullFileRefNumber_RenameCleanupTargetLinkFcbFileReference HexInt64 | |
A16_RenameCleanupTargetLinkFcbTxfFcbTxfNumWriters Int32 |
Event ID 298
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_LcbToDeleteFcb Pointer | |
A15_NtfsFullFileRefNumber_LcbToDeleteFcbFileReference HexInt64 | |
A16_LcbToDelete Pointer | |
A17_WppCountedStringWLcbToDeleteFileNameAttrFileNameUSHORTLcbToDeleteFileNameAttrFileNameLength CountedUtf16String | |
A18_LcbToDeleteTxfNumWriters Int32 |
Event ID 299
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_RenameCleanupTargetLinkFcb Pointer | |
A15_NtfsFullFileRefNumber_RenameCleanupTargetLinkFcbFileReference HexInt64 | |
A16_RenameCleanupTargetLinkFcbCleanupCount Int32 |
Event ID 300
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_LcbToDeleteFcb Pointer | |
A15_NtfsFullFileRefNumber_LcbToDeleteFcbFileReference HexInt64 | |
A16_LcbToDelete Pointer | |
A17_WppCountedStringWLcbToDeleteFileNameAttrFileNameUSHORTLcbToDeleteFileNameAttrFileNameLength CountedUtf16String | |
A18_LcbToDeleteCleanupCount Int32 | |
A19_SplitPrimaryLcb Pointer | |
A20_SplitPrimaryLcbNULLWppCountedStringWSplitPrimaryLcbFileNameAttrFileNameUSHORTSplitPrimaryLcbFileNameAttrFileNameLengthWppCountedStringWNULL0 CountedUtf16String | |
A21_SplitPrimaryLcbNULLSplitPrimaryLcbCleanupCount0 Int32 |
Event ID 301
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_LcbFcb Pointer | |
A15_NtfsFullFileRefNumber_LcbFcbFileReference HexInt64 | |
A16_LcbFcbFcbState HexInt32 | |
A17_Lcb Pointer | |
A18_WppCountedStringWLcbFileNameAttrFileNameUSHORTLcbFileNameAttrFileNameLength CountedUtf16String | |
A19_LcbFileNameAttrFlags HexInt32 | |
A20_LcbLcbState HexInt32 |
Event ID 302
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_ScbFcbInfoFileAttributes HexInt32 |
Event ID 303
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_TargetParentScbFcb Pointer | |
A15_NtfsFullFileRefNumber_TargetParentScbFcbFileReference HexInt64 | |
A16_TargetParentScbFcbFcbState HexInt32 |
Event ID 304
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_TargetParentScbFcb Pointer | |
A15_NtfsFullFileRefNumber_TargetParentScbFcbFileReference HexInt64 | |
A16_TargetParentScbFcbInfoFileAttributes HexInt32 | |
A17_TargetParentScbFcbFcbState HexInt32 |
Event ID 305
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 |
Event ID 306
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_NtfsFullFileRefNumber_TargetParentScbFcbFileReference HexInt64 |
Event ID 307
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String |
Event ID 308
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_TxfVisibleLinks Int32 |
Event ID 309
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_AccessStatus HexInt32 |
Event ID 310
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_TargetParentScbFcb Pointer | |
A15_NtfsFullFileRefNumber_TargetParentScbFcbFileReference HexInt64 | |
A16__NewLinkName CountedUtf16String |
Event ID 311
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_TargetParentScbFcb Pointer | |
A15_NtfsFullFileRefNumber_TargetParentScbFcbFileReference HexInt64 | |
A16__NewLinkName CountedUtf16String | |
A17_TargetParentScbFcbTxfRmcbRmState HexInt32 |
Event ID 312
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_LcbFcb Pointer | |
A15_NtfsFullFileRefNumber_LcbFcbFileReference HexInt64 | |
A16_Lcb Pointer | |
A17_WppCountedStringWLcbFileNameAttrFileNameUSHORTLcbFileNameAttrFileNameLength CountedUtf16String |
Event ID 313
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_LcbFcb Pointer | |
A15_NtfsFullFileRefNumber_LcbFcbFileReference HexInt64 | |
A16_Lcb Pointer | |
A17_WppCountedStringWLcbFileNameAttrFileNameUSHORTLcbFileNameAttrFileNameLength CountedUtf16String | |
A18_NtfsFullFileRefNumber_ParentScbFcbFileReference HexInt64 |
Event ID 314
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_NextScbVcb Pointer | |
A12__NextScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWNextScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHNextScbVcbVpb CountedUtf16String | |
A14_NextScbFcb Pointer | |
A15_NtfsFullFileRefNumber_NextScbFcbFileReference HexInt64 | |
A16_NextScbCleanupCount Int32 |
Event ID 315
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_NextScbVcb Pointer | |
A12__NextScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWNextScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHNextScbVcbVpb CountedUtf16String | |
A14_NextScbFcb Pointer | |
A15_NtfsFullFileRefNumber_NextScbFcbFileReference HexInt64 | |
A16_ByIdCcbs Int32 | |
A17_NextScbCleanupCount Int32 |
Event ID 316
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_ScbState HexInt32 | |
A20_ScbScbTypeDataHighWaterMark Int64 |
Event ID 317
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_DirectoryScbVcb Pointer | |
A12__DirectoryScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWDirectoryScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHDirectoryScbVcbVpb CountedUtf16String | |
A14_DirectoryScbFcb Pointer | |
A15_NtfsFullFileRefNumber_DirectoryScbFcbFileReference HexInt64 | |
A16_ULONGIrpIoStatusInformation Int32 | |
A17_BatchOplockCount Int32 |
Event ID 318
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12_Fcb Pointer | |
A13_LocalFlagsEntireFlags HexInt32 |
Event ID 320
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12_LocalFlagsEntireFlags HexInt32 |
Event ID 323
#Fields #
| Name | Description |
|---|---|
A10_PNTFS_DISK_FLUSH_CONTEXTContextVcb Pointer | |
A11_Context Pointer |
Event ID 324
#Fields #
| Name | Description |
|---|---|
A10_PNTFS_DISK_FLUSH_CONTEXTContextVcb Pointer | |
A11_Context Pointer | |
A12_NtfsDataDiskFlushContextCompletedWorkItemListFlink Pointer |
Event ID 325
#Event ID 326
#Event ID 327
#Fields #
| Name | Description |
|---|---|
A10_Irp Pointer | |
A11_IrpContext Pointer | |
A12_IrpContextVcb Pointer | |
A13_IrpSpMinorFunction HexInt32 | |
A14_FsControlCode HexInt32 |
Event ID 328
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbVcbState HexInt32 | |
A15_VcbDisallowDismountCount Int32 | |
A16_ExplicitLock10 Int32 | |
A17_ReadULongNoFence_VcbCleanupCount Int32 | |
A18_UserHandleCountSystemHandleCountVcbExternalMetadataCleanupCount Int32 |
Event ID 329
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbVcbState HexInt32 |
Event ID 330
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Status HexInt32 |
Event ID 331
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Status HexInt32 |
Event ID 332
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbCloseCount Int32 | |
A15_VcbSystemFileCloseCount Int32 | |
A16_UserHandleCount Int32 |
Event ID 333
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 334
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ActiveRmCount Int32 | |
A15_DefaultRmActive10 Int32 |
Event ID 335
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDVcbTxfVcbDefaultRm Pointer | |
A12_VcbTxfVcbDefaultRmNULL_VcbTxfVcbDefaultRmRmIdNULL GUID |
Event ID 336
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 337
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12__VolumeLabel CountedUtf16String | |
A13__VcbDeviceName CountedUtf16String |
Event ID 338
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 339
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbVcbState HexInt32 |
Event ID 340
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbVcbState HexInt32 | |
A15_VcbReadOnlyCloseCount Int32 | |
A16_VcbCloseCount Int32 | |
A17_VcbSystemFileCloseCount Int32 |
Event ID 341
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbVcbState HexInt32 |
Event ID 342
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 343
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 344
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbAccessFlags HexInt32 |
Event ID 345
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbAccessFlags HexInt32 |
Event ID 346
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbAccessFlags HexInt32 |
Event ID 347
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 | |
A15_TypeOfOpen Int32 |
Event ID 348
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 | |
A15_IrpRequestorMode Int32 |
Event ID 349
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 350
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 351
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbAccessFlags HexInt32 | |
A15_CcbFlags HexInt32 |
Event ID 352
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbAccessFlags HexInt32 | |
A15_CcbFlags HexInt32 | |
A16_CallerId Int32 | |
A17_ContextOwnerId Int32 |
Event ID 353
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 | |
A18_FileObjectWriteAccess10 Int32 |
Event ID 354
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 | |
A18_ScbAttributeFlags HexInt32 |
Event ID 355
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ZeroFlags HexInt32 | |
A12_IrpRequestorMode Int32 |
Event ID 356
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Scb Pointer | |
A12_IrpSpFileObject Pointer |
Event ID 358
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 |
Event ID 359
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 |
Event ID 360
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 361
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 362
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 365
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 | |
A18_HandleInfoHandleInfo HexInt32 | |
A19_IrpRequestorMode Int32 |
Event ID 366
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_DasdCcbNULLDasdCcbAccessFlags0 HexInt32 |
Event ID 367
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_ScbPersist HexInt32 | |
A20_HandleInfoHandleInfo HexInt32 |
Event ID 368
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_FcbFcbState2 HexInt32 | |
A17_Scb Pointer | |
A18_ScbAttributeTypeCode HexInt32 | |
A19__ScbAttributeName CountedUtf16String | |
A20_ScbPersist HexInt32 | |
A21_HandleInfoHandleInfo HexInt32 |
Event ID 369
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_FcbFcbState HexInt32 | |
A17_Scb Pointer | |
A18_ScbAttributeTypeCode HexInt32 | |
A19__ScbAttributeName CountedUtf16String | |
A20_ScbPersist HexInt32 | |
A21_HandleInfoHandleInfo HexInt32 | |
A22_IrpRequestorMode Int32 |
Event ID 370
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_ScbFcbFcbState HexInt32 | |
A17_HandleInfoHandleInfo HexInt32 |
Event ID 371
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_HandleInfoHandleInfo HexInt32 |
Event ID 372
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_ScbShareAccessWriters Int32 |
Event ID 373
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 374
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_TypeOfOpen Int32 | |
A15_IrpSpFileObjectWriteAccess10 Int32 | |
A16_ScbFcb Pointer | |
A17_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A18_ScbAttributeTypeCode HexInt32 | |
A19_ScbFcbFcbState HexInt32 | |
A20_CcbNULL_CcbFullFileNameNULL CountedUtf16String |
Event ID 375
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 377
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 378
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 379
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_IrpContextVcb Pointer | |
A12__IrpContextVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWIrpContextVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHIrpContextVcbVpb CountedUtf16String | |
A14_NtfsDataFlags HexInt32 |
Event ID 380
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 382
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 383
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 384
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_IrpContextVcb Pointer | |
A12__IrpContextVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWIrpContextVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHIrpContextVcbVpb CountedUtf16String |
Event ID 385
#Fields #
| Name | Description |
|---|---|
A10_ScrubResumeContextSystemScbIndex UInt32 | |
A11_ScrubResumeContextResumeVcn HexInt64 | |
A12_ScrubResumeContextResumeVcnOffset HexInt32 |
Event ID 386
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_ScrubResumeContextResumeVcn HexInt64 | |
A12_ScrubResumeContextResumeVcnOffset HexInt32 |
Event ID 388
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_TypeOfOpen Int32 | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17__CcbFullFileName CountedUtf16String | |
A18_CcbAccessFlags HexInt32 |
Event ID 390
#Event ID 391
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_ScrubContextOperationStatus HexInt32 | |
A12_ScrubContextNumberOfBytesRepaired HexInt64 | |
A13_ScrubContextNumberOfBytesFailed HexInt64 | |
A14_ScrubContextErrorFileOffset HexInt64 | |
A15_ScrubContextErrorLength HexInt64 | |
A16_ScrubContextParityExtentDataNumberOfParityExtents UInt32 |
Event ID 392
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_Status HexInt32 | |
A12_ScrubContextNumberOfBytesRepaired HexInt64 | |
A13_ScrubContextNumberOfBytesFailed HexInt64 | |
A14_ScrubContextParityExtentDataNumberOfParityExtents UInt32 |
Event ID 395
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_ScrubIoCount UInt32 | |
A12_IrpCancel UInt32 | |
A13_ScrubContextParityExtentDataNumberOfParityExtents UInt32 |
Event ID 399
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_FileScrubOffset HexInt64 | |
A12_SectorAlignedVdl HexInt64 |
Event ID 401
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_StartingVcn HexInt64 | |
A12_ClusterCount HexInt64 |
Event ID 403
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_DsmRangeStartingOffset HexInt64 | |
A12_DsmRangeStartingOffsetDsmRangeLengthInBytes HexInt64 | |
A13_DsmRangeLengthInBytes HexInt64 | |
A14_StartingVcn HexInt64 | |
A15_StartingVcnOffset HexInt32 | |
A16_SectorAlignedVdl HexInt64 |
Event ID 404
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_StartingVcn HexInt64 | |
A12_ScrubContextErrorFileOffset HexInt64 | |
A13_ScrubbedLength HexInt64 | |
A14_ScrubContextOperationStatus HexInt32 | |
A15_ScrubContextNumberOfBytesFailed HexInt64 | |
A16_ScrubContextNumberOfBytesRepaired HexInt64 | |
A17_NewParityExtentCount UInt32 |
Event ID 410
#Event ID 411
#Event ID 414
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_StartingVcn HexInt64 | |
A12_ClusterCount HexInt64 |
Event ID 415
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_RepairDataSetRangeStartingOffset HexInt64 | |
A12_RepairDataSetRangeStartingOffsetRepairDataSetRangeLengthInBytes HexInt64 | |
A13_RepairDataSetRangeLengthInBytes HexInt64 | |
A14_RepairFileOffset HexInt64 |
Event ID 419
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_TypeOfOpen Int32 | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17__CcbFullFileName CountedUtf16String | |
A18_CcbAccessFlags HexInt32 |
Event ID 420
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_TypeOfOpen Int32 | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 421
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_TypeOfOpen Int32 | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 422
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_TypeOfOpen Int32 | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 423
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String |
Event ID 424
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_TypeOfOpen Int32 | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_IrpRequestorMode Int32 |
Event ID 425
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_VcbVcbState HexInt32 |
Event ID 426
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_ScbPersist HexInt32 | |
A20_CcbNULLCcbFlags0 HexInt32 |
Event ID 427
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_FcbInfoFileAttributes HexInt32 | |
A17_IrpSpFlags HexInt32 |
Event ID 428
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A17_IrpRequestorMode Int32 |
Event ID 429
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A17_VcbVcbState HexInt32 |
Event ID 430
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_ScbPersist HexInt32 | |
A20_CcbNULLCcbFlags0 HexInt32 |
Event ID 431
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_FcbInfoFileAttributes HexInt32 | |
A17_IrpSpFlags HexInt32 |
Event ID 432
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A15_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A16_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 433
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_ScbAttributeTypeCode HexInt32 | |
A18_ScbFcbFcbState2 HexInt32 | |
A19_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A20_CcbNULLCcbAccessFlags0 HexInt32 | |
A21_CcbNULLCcbFlags20 HexInt32 |
Event ID 434
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_ScbAttributeTypeCode HexInt32 | |
A18_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A19_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 435
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A17_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 436
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_PsGetCurrentThread Pointer | |
A12_Status HexInt32 | |
A13__DeletedFiles CountedUtf16String |
Event ID 437
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_PsGetCurrentThread Pointer | |
A12_Status HexInt32 |
Event ID 438
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_PsGetCurrentThread Pointer | |
A12_Status HexInt32 | |
A13__FileNameToDelete CountedUtf16String |
Event ID 439
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_PsGetCurrentThread Pointer | |
A12_Status HexInt32 |
Event ID 440
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_PsGetCurrentThread Pointer | |
A12_Status HexInt32 |
Event ID 441
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_CcbNULLCcbAccessFlags0 HexInt32 | |
A19_EffectiveMode Int32 |
Event ID 442
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_StartOffset HexInt64 | |
A12_Length HexInt64 | |
A13_StartVcn HexInt64 | |
A14_BeyondEndVcn HexInt64 |
Event ID 444
#Fields #
| Name | Description |
|---|---|
A10_FsInputRangeIndex UInt32 | |
A11_FsInputRangesFsInputRangeIndexFileOffset HexInt64 | |
A12_FsInputRangesFsInputRangeIndexVolumeOffset HexInt64 | |
A13_FsInputRangesFsInputRangeIndexLengthInBytes HexInt64 |
Event ID 445
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_Status HexInt32 | |
A12_BOOLEANAbnormalTermination UInt8 |
Event ID 447
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_IrpContextVcb Pointer | |
A12__IrpContextVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWIrpContextVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHIrpContextVcbVpb CountedUtf16String |
Event ID 448
#Event ID 449
#Fields #
| Name | Description |
|---|---|
A10_Table Pointer | |
A11_ParentScb Pointer | |
A12__ParentScbScbTypeIndexNormalizedName CountedUtf16String | |
A13_RemainingName CountedUtf16String |
Event ID 450
#Event ID 451
#Fields #
| Name | Description |
|---|---|
A10_FoundLcb Pointer | |
A11__FoundLcbExactCaseLinkLinkName CountedUtf16String |
Event ID 452
#Event ID 453
#Fields #
| Name | Description |
|---|---|
A10_Table Pointer | |
A11_NewHashEntryHashValue HexInt32 | |
A12_NewHashEntryFullNameLength Int32 | |
A13_NewHashEntryHashLcb Pointer | |
A14__NewHashEntryHashLcbExactCaseLinkLinkName CountedUtf16String |
Event ID 454
#Fields #
| Name | Description |
|---|---|
A10_Table Pointer | |
A11_HashValue HexInt32 | |
A12_HashLcb Pointer | |
A13__HashLcbExactCaseLinkLinkName CountedUtf16String |
Event ID 464
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_NtfsFullSegmentNumber_ScbFcbFileReference HexInt64 |
Event ID 466
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbVcbState HexInt32 |
Event ID 471
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_IrpContextOriginatingIrp Pointer | |
A12_PsGetCurrentThread Pointer | |
A13_IrpContextExceptionStatus HexInt32 |
Event ID 472
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_IrpContextOriginatingIrp Pointer | |
A12_PsGetCurrentThread Pointer | |
A13_IrpContextExceptionStatus HexInt32 |
Event ID 473
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_IrpContextOriginatingIrp Pointer | |
A12_PsGetCurrentThread Pointer | |
A13_IrpContextExceptionStatus HexInt32 | |
A14_FailedFlushCount Int32 |
Event ID 474
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_IrpContextOriginatingIrp Pointer | |
A12_PsGetCurrentThread Pointer | |
A13_IrpContextExceptionStatus HexInt32 |
Event ID 475
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_IrpContextOriginatingIrp Pointer | |
A12_PsGetCurrentThread Pointer | |
A13_IrpContextExceptionStatus HexInt32 |
Event ID 478
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_ActiveLsnQuadPart HexInt64 | |
A12_ClearAll UInt32 |
Event ID 484
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_Clusters Pointer | |
A12_ClustersClusterCount HexInt64 | |
A13_ClustersLsnQuadPart HexInt64 | |
A14_ClustersFlags HexInt32 |
Event ID 485
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_Clusters Pointer | |
A12_i Int32 | |
A13_StartingLcn HexInt64 | |
A14_ClusterCount HexInt64 |
Event ID 486
#Event ID 491
#Event ID 492
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_StartingLcn HexInt64 | |
A12_ULONGClusterCount HexInt32 |
Event ID 493
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_StartingLcnStartingIndex HexInt64 | |
A12_runLength HexInt32 |
Event ID 497
#Fields #
| Name | Description |
|---|---|
A10_McbScb Pointer | |
A11_Mcb Pointer | |
A12_StartingVcn HexInt64 | |
A13_Count HexInt64 |
Event ID 499
#Fields #
| Name | Description |
|---|---|
A10_McbScb Pointer | |
A11_Mcb Pointer | |
A12_Vcn HexInt64 | |
A13_Lcn HexInt64 | |
A14_RunCount HexInt64 |
Event ID 501
#Fields #
| Name | Description |
|---|---|
A10_McbScb Pointer | |
A11_Mcb Pointer | |
A12_StartingVcn HexInt64 | |
A13_EndingVcn HexInt64 | |
A14_TruncateOnly UInt32 |
Event ID 505
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_IrpContextExceptionStatus HexInt32 |
Event ID 510
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_AttrListAllocationSize HexInt64 |
Event ID 511
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_AttrListAllocationSize HexInt64 |
Event ID 515
#Fields #
| Name | Description |
|---|---|
A10_IrpContextLogFullReason UInt32 | |
A11_BackTrace0 Pointer | |
A12_BackTrace1 Pointer | |
A13_BackTrace2 Pointer | |
A14_BackTrace3 Pointer | |
A15_BackTrace4 Pointer | |
A16_BackTrace5 Pointer | |
A17_BackTrace6 Pointer | |
A18_BackTrace7 Pointer | |
A19_BackTrace8 Pointer | |
A20_BackTrace9 Pointer | |
A21_BackTrace10 Pointer | |
A22_BackTrace11 Pointer | |
A23_BackTrace12 Pointer | |
A24_BackTrace13 Pointer | |
A25_BackTrace14 Pointer | |
A26_BackTrace15 Pointer | |
A27_BackTrace16 Pointer | |
A28_BackTrace17 Pointer | |
A29_BackTrace18 Pointer | |
A30_BackTrace19 Pointer |
Event ID 519
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Irp Pointer | |
A12_IrpContextVcb Pointer | |
A13_NtfsFailedAborts HexInt32 | |
A14_GetExceptionCode HexInt32 |
Event ID 520
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Irp Pointer | |
A12_IrpContextVcb Pointer | |
A13_NextScb Pointer | |
A14_PULONGLONG_NextScbFcbFileReference HexInt64 |
Event ID 521
#Fields #
| Name | Description |
|---|---|
A10_IrpSpParametersWriteByteOffsetHighPart HexInt32 | |
A11_IrpSpParametersWriteByteOffsetLowPart HexInt32 |
Event ID 522
#Fields #
| Name | Description |
|---|---|
A10_ExceptionCode HexInt32 | |
A11_IrpSpParametersWriteByteOffsetHighPart HexInt32 | |
A12_IrpSpParametersWriteByteOffsetLowPart HexInt32 |
Event ID 523
#Fields #
| Name | Description |
|---|---|
A10_IrpSpMajorFunction UInt32 | |
A11_IrpSpMinorFunction HexInt32 | |
A12_Irp Pointer | |
A13_IrpContext Pointer | |
A14_Status HexInt32 |
Event ID 524
#Fields #
| Name | Description |
|---|---|
A10_IrpSpMajorFunction UInt32 | |
A11_IrpSpMinorFunction HexInt32 | |
A12_Irp Pointer | |
A13_IrpContext Pointer | |
A14_Status HexInt32 |
Event ID 525
#Event ID 526
#Event ID 529
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 | |
A18_IrpSpMinorFunction HexInt32 |
Event ID 530
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 | |
A18_IrpSpMinorFunction HexInt32 |
Event ID 531
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 | |
A18_IrpSpMinorFunction HexInt32 |
Event ID 532
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDVcbTxfVcbDefaultRm Pointer | |
A12__VcbTxfVcbDefaultRmRmId GUID |
Event ID 533
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_IrpContextVcb Pointer | |
A12__IrpContextVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWIrpContextVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHIrpContextVcbVpb CountedUtf16String |
Event ID 534
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17__CcbFullFileName CountedUtf16String | |
A18_CcbAccessFlags HexInt32 | |
A19_CcbFlags HexInt32 |
Event ID 536
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 | |
A18_IrpSpFileObjectWriteAccess Int32 |
Event ID 537
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 | |
A18_IrpSpFileObjectWriteAccess Int32 |
Event ID 538
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 | |
A18_IrpSpFileObjectWriteAccess Int32 |
Event ID 539
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_VcbLogFileObject Pointer | |
A12_IrpContext Pointer |
Event ID 541
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_VcbLogFileObject Pointer | |
A12_IrpContext Pointer |
Event ID 544
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_FileRecordSegmentNumberHighPart HexInt32 | |
A12_FileRecordSegmentNumberLowPart HexInt32 | |
A13_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 |
Event ID 545
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_FileRecordSegmentNumberHighPart HexInt32 | |
A12_FileRecordSegmentNumberLowPart HexInt32 | |
A13_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 |
Event ID 546
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_FileRecordSegmentNumberHighPart HexInt32 | |
A12_FileRecordSegmentNumberLowPart HexInt32 | |
A13_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 | |
A14_AttributeTypeCode HexInt32 | |
A15_LogRecordRecordOffset HexInt32 | |
A16_Length HexInt32 |
Event ID 547
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_FileRecordSegmentNumberHighPart HexInt32 | |
A12_FileRecordSegmentNumberLowPart HexInt32 | |
A13_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 | |
A14_PATTRIBUTE_RECORD_HEADERDataTypeCode HexInt32 |
Event ID 548
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_FileRecordSegmentNumberHighPart HexInt32 | |
A12_FileRecordSegmentNumberLowPart HexInt32 | |
A13_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 | |
A14_NtfsFullSegmentNumber_FileReference HexInt64 |
Event ID 549
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_FileRecordSegmentNumberHighPart HexInt32 | |
A12_FileRecordSegmentNumberLowPart HexInt32 | |
A13_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 | |
A14_AttributeFormNonresidentAllocatedLength HexInt64 | |
A15_AttributeFormNonresidentFileSize HexInt64 | |
A16_AttributeFormNonresidentValidDataLength HexInt64 | |
A17_AttributeFormNonresidentTotalAllocated HexInt64 | |
A18_SizesAllocationSize HexInt64 | |
A19_SizesFileSize HexInt64 | |
A20_SizesValidDataLength HexInt64 | |
A21_SizesTotalAllocated HexInt64 |
Event ID 552
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 |
Event ID 553
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 |
Event ID 554
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String |
Event ID 555
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisFcbTxfFcbTxfNumWriters Int32 |
Event ID 556
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_Status HexInt32 |
Event ID 557
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisFcbInfoFileAttributes HexInt32 |
Event ID 558
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisFcbInfoFileAttributes HexInt32 |
Event ID 559
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 |
Event ID 560
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisFcbInfoFileAttributes HexInt32 | |
A17_IrpSpFlags HexInt32 |
Event ID 561
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_CcbAccessFlags HexInt32 | |
A17_AccessStatus HexInt32 |
Event ID 562
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_NextScb Pointer | |
A17_NextScbAttributeTypeCode HexInt32 | |
A18__NextScbAttributeName CountedUtf16String |
Event ID 563
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A17_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 564
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbVcbState HexInt32 |
Event ID 565
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A17_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 566
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A17_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 567
#Event ID 568
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_Fcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 569
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_Fcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 570
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_Fcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 571
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_FcbFcbState HexInt32 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String |
Event ID 572
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A17_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 573
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A17_CcbNULLCcbAccessFlags0 HexInt32 | |
A18_Flags HexInt32 |
Event ID 574
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A17_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 578
#Fields #
| Name | Description |
|---|---|
A10_CurrentClusters Pointer | |
A11_CurrentClustersLsnQuadPart HexInt64 |
Event ID 579
#Fields #
| Name | Description |
|---|---|
A10_ClustersLinkAsHead Pointer | |
A11_FlagsToMatch HexInt32 | |
A12_InsertAfter UInt32 |
Event ID 583
#Event ID 584
#Fields #
| Name | Description |
|---|---|
A10_FlagOnClustersFlagsDEALLOCATED_CLUSTERS_FLAG_NO_DANGLING_MDL UInt32 | |
A11_Clusters Pointer | |
A12_Lcn HexInt64 | |
A13_ClusterCount HexInt64 |
Event ID 585
#Fields #
| Name | Description |
|---|---|
A10_FlagOnClustersFlagsDEALLOCATED_CLUSTERS_FLAG_NO_DANGLING_MDL UInt32 | |
A11_Clusters Pointer | |
A12_Lcn HexInt64 | |
A13_ClusterCount HexInt64 |
Event ID 586
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_TxfFcbFlags HexInt32 | |
A17_ShareMode HexInt32 |
Event ID 587
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_GrantedAccess HexInt32 |
Event ID 588
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_GrantedAccess HexInt32 |
Event ID 589
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_GrantedAccess HexInt32 | |
A17_NextTxfVscbReaderCleanupCount Int32 |
Event ID 590
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_CallerFunction AnsiString | |
A12_CallerFile AnsiString | |
A13_CallerLineNumber Int32 | |
A14_PVOIDTxfRmcb Pointer | |
A15__TxfRmcbRmId GUID | |
A16_PVOIDTxfTrans Pointer | |
A17__TxfTransKtmUow GUID | |
A18_AbortReasonStatus HexInt32 |
Event ID 591
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_CallerFunction AnsiString | |
A12_CallerFile AnsiString | |
A13_CallerLineNumber Int32 | |
A14_PVOIDTxfRmcb Pointer | |
A15__TxfRmcbRmId GUID | |
A16_PVOIDTxfTrans Pointer | |
A17__TxfTransKtmUow GUID | |
A18_Status HexInt32 |
Event ID 592
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_TxfTrans Pointer | |
A14__TxfTransKtmUow GUID |
Event ID 593
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_TxfTrans Pointer | |
A14__TxfTransKtmUow GUID |
Event ID 594
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDCalloutParametersTxfFlushTxfRmcb Pointer | |
A12__CalloutParametersTxfFlushTxfRmcbRmId GUID | |
A13_GetExceptionCode HexInt32 |
Event ID 605
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbTxfVcbFlags HexInt32 |
Event ID 606
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_TempStatus HexInt32 | |
A12_PVOIDVcb Pointer |
Event ID 607
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_GetExceptionCode HexInt32 | |
A12_Status HexInt32 | |
A13_PVOIDVcb Pointer |
Event ID 610
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_NT_SUCCESSStatusSucceededFAILED AnsiString | |
A12_PVOIDTxfRmcb Pointer | |
A13__TxfRmcbRmId GUID | |
A14_Status HexInt32 |
Event ID 611
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 612
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 613
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 614
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbTxfVcbFlags HexInt32 |
Event ID 615
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 616
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbTxfVcbFlags HexInt32 |
Event ID 617
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 618
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_LogNestingLevel HexInt32 | |
A14_DiskNestingLevel HexInt32 |
Event ID 619
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 620
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 621
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13__ClfsRestartAreaRmId GUID |
Event ID 622
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_Status Int32 | |
A12_PVOIDTxfRmcb Pointer | |
A13__TxfRmcbRmId GUID |
Event ID 623
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 624
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 625
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 626
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_Status HexInt32 | |
A14_AbnormalTerminationabnormaltermination AnsiString |
Event ID 627
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_TxfIsDefaultRmTxfRmcbdefaultsecondary AnsiString | |
A12_PVOIDTxfRmcb Pointer | |
A13__TxfRmcbRmId GUID | |
A14_ForceDirtyShutdownDIRTYCLEAN AnsiString |
Event ID 628
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 629
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_FcbCleanupCount Int32 |
Event ID 630
#Fields #
| Name | Description |
|---|---|
A10_FILEID_FROM_SOURCEFileNLine UInt32 | |
A11_LINENUM_FROM_SOURCEFileNLine Int32 | |
A12_TxfRmcb Pointer | |
A13__TxfRmcbRmId GUID | |
A14_Status HexInt32 |
Event ID 631
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__OldGuid GUID | |
A13__TxfRmcbRmId GUID |
Event ID 632
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_PVOIDTxfTrans Pointer | |
A14__TxfTransKtmUow GUID | |
A15_Status HexInt32 |
Event ID 633
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__OldGuid GUID | |
A13__TxfRmcbRmId GUID |
Event ID 634
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_RmRootFcbVcb Pointer | |
A12__RmRootFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWRmRootFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHRmRootFcbVcbVpb CountedUtf16String | |
A14_RmRootFcb Pointer |
Event ID 635
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_BackupInfoFlags HexInt32 |
Event ID 636
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 637
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_Status HexInt32 | |
A12_PVOIDFileObject Pointer |
Event ID 638
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 639
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__CcbFullFileName CountedUtf16String | |
A19_CcbFlags HexInt32 |
Event ID 640
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_CcbTxfFo Pointer | |
A18_CcbTxfFoKtmTrans Pointer | |
A19_ScbFcbTxfRmcb Pointer | |
A20_CcbFullFileNameBuffer UnicodeString |
Event ID 641
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17__CcbFullFileName CountedUtf16String | |
A18_CcbAccessFlags HexInt32 | |
A19_FileObjectWriteAccess Int32 | |
A20_FileObjectDeleteAccess Int32 |
Event ID 642
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_ExceptionCode HexInt32 |
Event ID 643
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_TransactionNotification HexInt32 | |
A12_TransactionAlreadyPreparedPREPARED AnsiString | |
A13__TxfTransKtmUow GUID | |
A14_PVOIDTxfRmcb Pointer | |
A15__TxfRmcbRmId GUID | |
A16_Status HexInt32 |
Event ID 644
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_TxfTrans Pointer | |
A14__TxfTransKtmUow GUID |
Event ID 645
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_TxfTrans Pointer | |
A14__TxfTransKtmUow GUID |
Event ID 646
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTransTxfRmcb Pointer | |
A12__TransTxfRmcbRmId GUID | |
A13_FlushStatus HexInt32 |
Event ID 647
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_Trans Pointer | |
A14__TransKtmUow GUID |
Event ID 648
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_CallStack0 Pointer | |
A12_CallStack1 Pointer | |
A13_CallStack2 Pointer | |
A14_CallStack3 Pointer | |
A15_CallStack4 Pointer |
Event ID 649
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_Trans Pointer | |
A14__TransKtmUow GUID |
Event ID 650
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_Status HexInt32 | |
A12_PVOIDTrans Pointer | |
A13__TransKtmUow GUID | |
A14_PVOIDTxfRmcb Pointer | |
A15__TxfRmcbRmId GUID |
Event ID 651
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_Status HexInt32 | |
A12_PVOIDTxfRmcb Pointer | |
A13__TxfRmcbRmId GUID | |
A14_PVOIDTrans Pointer | |
A15__TransKtmUow GUID |
Event ID 652
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 653
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 654
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 655
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 656
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_OldestTrans Pointer | |
A14__OldestTransKtmUow GUID |
Event ID 657
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_Status HexInt32 | |
A14_OldestTrans Pointer | |
A15__OldestTransKtmUow GUID |
Event ID 660
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_PVOIDTransToDereference Pointer | |
A14__TransToDereferenceKtmUow GUID | |
A15_Status HexInt32 |
Event ID 661
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 662
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 663
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PinnedStatus HexInt32 | |
A12_PVOIDTxfRmcb Pointer | |
A13__TxfRmcbRmId GUID | |
A14_Status HexInt32 |
Event ID 664
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 665
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 666
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 667
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 668
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 669
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 670
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 671
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 672
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 673
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 674
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_IsEncrypted_TopsFcbInfoencryptedcompressed AnsiString |
Event ID 675
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 676
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 677
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 678
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 679
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 680
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 681
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 682
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 683
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 684
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_Fcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 685
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_VcbFirstValidUsn HexInt64 | |
A13_FirstValidUsn HexInt64 | |
A14_TrackUsnJournalFileSize HexInt64 | |
A15_TrackUsnJournalAllocationSize HexInt64 | |
A16_TrackUsnJournalMaxSize HexInt64 | |
A17_TrackUsnJournalDeltaAllocation HexInt64 |
Event ID 686
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_FirstValidUsn1 HexInt64 | |
A13_SavedReserved HexInt64 | |
A14_RequiredReserved HexInt64 |
Event ID 687
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_UsnJournalHeaderAllocationSizeQuadPart HexInt64 | |
A13_UsnJournalHeaderFileSizeQuadPart HexInt64 | |
A14_UsnJournalHeaderValidDataLengthQuadPart HexInt64 | |
A15_UsnJournalTotalAllocated HexInt64 |
Event ID 688
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_UsnJournalHeaderAllocationSizeQuadPart HexInt64 | |
A13_UsnJournalHeaderFileSizeQuadPart HexInt64 | |
A14_UsnJournalHeaderValidDataLengthQuadPart HexInt64 | |
A15_UsnJournalTotalAllocated HexInt64 |
Event ID 691
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_Fcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 |
Event ID 692
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A17_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 693
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_Fcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 694
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_ScbCleanupCount Int32 |
Event ID 695
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_IrpContextOriginatingIrp Pointer | |
A13_PsGetCurrentThread Pointer | |
A14_ScbHeaderAllocationSizeQuadPart HexInt64 | |
A15_ScbHeaderFileSizeQuadPart HexInt64 | |
A16_ScbHeaderValidDataLengthQuadPart HexInt64 | |
A17_NewAllocationSize HexInt64 |
Event ID 696
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_IrpContextOriginatingIrp Pointer | |
A13_PsGetCurrentThread Pointer | |
A14_ScbHeaderAllocationSizeQuadPart HexInt64 | |
A15_ScbHeaderFileSizeQuadPart HexInt64 | |
A16_ScbHeaderValidDataLengthQuadPart HexInt64 | |
A17_ScbTotalAllocated HexInt64 |
Event ID 697
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_IrpContextOriginatingIrp Pointer | |
A13_PsGetCurrentThread Pointer |
Event ID 698
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_IrpContextOriginatingIrp Pointer | |
A13_PsGetCurrentThread Pointer |
Event ID 699
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_IrpContextOriginatingIrp Pointer | |
A12_PsGetCurrentThread Pointer | |
A13_IrpContextExceptionStatus HexInt32 |
Event ID 700
#Fields #
| Name | Description |
|---|---|
A10_RemainingClusterCount HexInt64 | |
A11_Scb Pointer | |
A12_Vcn HexInt64 | |
A13_Lcn HexInt64 | |
A14_ClusterCount HexInt64 |
Event ID 710
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_WasDirty HexInt32 | |
A12_NtfsFullSegmentNumber_BugCheckFileReference HexInt64 | |
A13_Source HexInt64 |
Event ID 711
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_Fcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_FsInformationClass HexInt32 | |
A18_Scb Pointer |
Event ID 712
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_Fcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_FsInformationClass HexInt32 | |
A18_Scb Pointer |
Event ID 713
#Fields #
| Name | Description |
|---|---|
A10_IrpSpParametersWriteByteOffsetHighPart HexInt32 | |
A11_IrpSpParametersWriteByteOffsetLowPart HexInt32 | |
A12_IrpContextTopLevelIrpContextExceptionStatus HexInt32 |
Event ID 715
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ByteRange HexInt64 | |
A15_HIGHEST_WRITABLE_SECTOR_ON_ACTIVE_VOLUMEVcbSectorSizeInfoLogicalBytesPerSector HexInt64 |