Microsoft-Windows-NtfsLog_cdac24ce683a371108c05bb363714355
708 events across 1 channel
| Event | Title | Channel | Sample |
|---|---|---|---|
| 10 | Event ID 10 | Operational | N |
| 11 | Event ID 11 | Operational | N |
| 12 | Event ID 12 | Operational | N |
| 13 | Event ID 13 | Operational | N |
| 14 | Event ID 14 | Operational | N |
| 15 | Event ID 15 | Operational | N |
| 16 | Event ID 16 | Operational | N |
| 17 | Event ID 17 | Operational | N |
| 18 | Event ID 18 | Operational | N |
| 19 | Event ID 19 | Operational | N |
| 20 | Event ID 20 | Operational | N |
| 21 | Event ID 21 | Operational | N |
| 22 | Event ID 22 | Operational | N |
| 23 | Event ID 23 | Operational | N |
| 24 | Event ID 24 | Operational | N |
| 25 | Event ID 25 | Operational | N |
| 26 | Event ID 26 | Operational | N |
| 27 | Event ID 27 | Operational | N |
| 28 | Event ID 28 | Operational | N |
| 29 | Event ID 29 | Operational | N |
| 30 | Event ID 30 | Operational | N |
| 31 | Event ID 31 | Operational | N |
| 32 | Event ID 32 | Operational | N |
| 33 | Event ID 33 | Operational | N |
| 34 | Event ID 34 | Operational | N |
| 35 | Event ID 35 | Operational | N |
| 36 | Event ID 36 | Operational | N |
| 37 | Event ID 37 | Operational | N |
| 38 | Event ID 38 | Operational | N |
| 39 | Event ID 39 | Operational | N |
| 40 | Event ID 40 | Operational | N |
| 41 | Event ID 41 | Operational | N |
| 42 | Event ID 42 | Operational | N |
| 43 | Event ID 43 | Operational | N |
| 44 | Event ID 44 | Operational | N |
| 45 | Event ID 45 | Operational | N |
| 46 | Event ID 46 | Operational | N |
| 47 | Event ID 47 | Operational | N |
| 48 | Event ID 48 | Operational | N |
| 49 | Event ID 49 | Operational | N |
| 50 | Event ID 50 | Operational | N |
| 51 | Event ID 51 | Operational | N |
| 52 | Event ID 52 | Operational | N |
| 53 | Event ID 53 | Operational | N |
| 54 | Event ID 54 | Operational | N |
| 55 | Event ID 55 | Operational | N |
| 56 | Event ID 56 | Operational | N |
| 57 | Event ID 57 | Operational | N |
| 58 | Event ID 58 | Operational | N |
| 59 | Event ID 59 | Operational | N |
| 60 | Event ID 60 | Operational | N |
| 61 | Event ID 61 | Operational | N |
| 62 | Event ID 62 | Operational | N |
| 63 | Event ID 63 | Operational | N |
| 64 | Event ID 64 | Operational | N |
| 65 | Event ID 65 | Operational | N |
| 66 | Event ID 66 | Operational | N |
| 67 | Event ID 67 | Operational | N |
| 68 | Event ID 68 | Operational | N |
| 69 | Event ID 69 | Operational | N |
| 70 | Event ID 70 | Operational | N |
| 71 | Event ID 71 | Operational | N |
| 72 | Event ID 72 | Operational | N |
| 73 | Event ID 73 | Operational | N |
| 74 | Event ID 74 | Operational | N |
| 75 | Event ID 75 | Operational | N |
| 76 | Event ID 76 | Operational | N |
| 77 | Event ID 77 | Operational | N |
| 78 | Event ID 78 | Operational | N |
| 79 | Event ID 79 | Operational | N |
| 80 | Event ID 80 | Operational | N |
| 81 | Event ID 81 | Operational | N |
| 82 | Event ID 82 | Operational | N |
| 83 | Event ID 83 | Operational | N |
| 84 | Event ID 84 | Operational | N |
| 85 | Event ID 85 | Operational | N |
| 86 | Event ID 86 | Operational | N |
| 87 | Event ID 87 | Operational | N |
| 88 | Event ID 88 | Operational | N |
| 89 | Event ID 89 | Operational | N |
| 90 | Event ID 90 | Operational | N |
| 91 | Event ID 91 | Operational | N |
| 92 | Event ID 92 | Operational | N |
| 93 | Event ID 93 | Operational | N |
| 94 | Event ID 94 | Operational | N |
| 95 | Event ID 95 | Operational | N |
| 96 | Event ID 96 | Operational | N |
| 97 | Event ID 97 | Operational | N |
| 98 | Event ID 98 | Operational | N |
| 99 | Event ID 99 | Operational | N |
| 100 | Event ID 100 | Operational | N |
| 101 | Event ID 101 | Operational | N |
| 102 | Event ID 102 | Operational | N |
| 103 | Event ID 103 | Operational | N |
| 104 | Event ID 104 | Operational | N |
| 105 | Event ID 105 | Operational | N |
| 106 | Event ID 106 | Operational | N |
| 107 | Event ID 107 | Operational | N |
| 108 | Event ID 108 | Operational | N |
| 109 | Event ID 109 | Operational | N |
| 110 | Event ID 110 | Operational | N |
| 111 | Event ID 111 | Operational | N |
| 112 | Event ID 112 | Operational | N |
| 113 | Event ID 113 | Operational | N |
| 114 | Event ID 114 | Operational | N |
| 115 | Event ID 115 | Operational | N |
| 116 | Event ID 116 | Operational | N |
| 117 | Event ID 117 | Operational | N |
| 118 | Event ID 118 | Operational | N |
| 119 | Event ID 119 | Operational | N |
| 120 | Event ID 120 | Operational | N |
| 121 | Event ID 121 | Operational | N |
| 122 | Event ID 122 | Operational | N |
| 123 | Event ID 123 | Operational | N |
| 124 | Event ID 124 | Operational | N |
| 125 | Event ID 125 | Operational | N |
| 126 | Event ID 126 | Operational | N |
| 127 | Event ID 127 | Operational | N |
| 128 | Event ID 128 | Operational | N |
| 129 | Event ID 129 | Operational | N |
| 130 | Event ID 130 | Operational | N |
| 131 | Event ID 131 | Operational | N |
| 132 | Event ID 132 | Operational | N |
| 133 | Event ID 133 | Operational | N |
| 134 | Event ID 134 | Operational | N |
| 135 | Event ID 135 | Operational | N |
| 136 | Event ID 136 | Operational | N |
| 137 | Event ID 137 | Operational | N |
| 138 | Event ID 138 | Operational | N |
| 139 | Event ID 139 | Operational | N |
| 140 | Event ID 140 | Operational | N |
| 141 | Event ID 141 | Operational | N |
| 142 | Event ID 142 | Operational | N |
| 143 | Event ID 143 | Operational | N |
| 144 | Event ID 144 | Operational | N |
| 145 | Event ID 145 | Operational | N |
| 146 | Event ID 146 | Operational | N |
| 147 | Event ID 147 | Operational | N |
| 148 | Event ID 148 | Operational | N |
| 149 | Event ID 149 | Operational | N |
| 150 | Event ID 150 | Operational | N |
| 151 | Event ID 151 | Operational | N |
| 152 | Event ID 152 | Operational | N |
| 153 | Event ID 153 | Operational | N |
| 154 | Event ID 154 | Operational | N |
| 155 | Event ID 155 | Operational | N |
| 156 | Event ID 156 | Operational | N |
| 157 | Event ID 157 | Operational | N |
| 158 | Event ID 158 | Operational | N |
| 159 | Event ID 159 | Operational | N |
| 160 | Event ID 160 | Operational | N |
| 161 | Event ID 161 | Operational | N |
| 162 | Event ID 162 | Operational | N |
| 163 | Event ID 163 | Operational | N |
| 164 | Event ID 164 | Operational | N |
| 165 | Event ID 165 | Operational | N |
| 166 | Event ID 166 | Operational | N |
| 167 | Event ID 167 | Operational | N |
| 168 | Event ID 168 | Operational | N |
| 169 | Event ID 169 | Operational | N |
| 170 | Event ID 170 | Operational | N |
| 171 | Event ID 171 | Operational | N |
| 172 | Event ID 172 | Operational | N |
| 173 | Event ID 173 | Operational | N |
| 174 | Event ID 174 | Operational | N |
| 175 | Event ID 175 | Operational | N |
| 176 | Event ID 176 | Operational | N |
| 177 | Event ID 177 | Operational | N |
| 178 | Event ID 178 | Operational | N |
| 179 | Event ID 179 | Operational | N |
| 180 | Event ID 180 | Operational | N |
| 181 | Event ID 181 | Operational | N |
| 182 | Event ID 182 | Operational | N |
| 183 | Event ID 183 | Operational | N |
| 184 | Event ID 184 | Operational | N |
| 185 | Event ID 185 | Operational | N |
| 186 | Event ID 186 | Operational | N |
| 187 | Event ID 187 | Operational | N |
| 188 | Event ID 188 | Operational | N |
| 189 | Event ID 189 | Operational | N |
| 190 | Event ID 190 | Operational | N |
| 191 | Event ID 191 | Operational | N |
| 192 | Event ID 192 | Operational | N |
| 193 | Event ID 193 | Operational | N |
| 194 | Event ID 194 | Operational | N |
| 195 | Event ID 195 | Operational | N |
| 196 | Event ID 196 | Operational | N |
| 197 | Event ID 197 | Operational | N |
| 198 | Event ID 198 | Operational | N |
| 199 | Event ID 199 | Operational | N |
| 200 | Event ID 200 | Operational | N |
| 201 | Event ID 201 | Operational | N |
| 202 | Event ID 202 | Operational | N |
| 203 | Event ID 203 | Operational | N |
| 204 | Event ID 204 | Operational | N |
| 205 | Event ID 205 | Operational | N |
| 206 | Event ID 206 | Operational | N |
| 207 | Event ID 207 | Operational | N |
| 208 | Event ID 208 | Operational | N |
| 209 | Event ID 209 | Operational | N |
| 210 | Event ID 210 | Operational | N |
| 211 | Event ID 211 | Operational | N |
| 212 | Event ID 212 | Operational | N |
| 213 | Event ID 213 | Operational | N |
| 214 | Event ID 214 | Operational | N |
| 215 | Event ID 215 | Operational | N |
| 216 | Event ID 216 | Operational | N |
| 217 | Event ID 217 | Operational | N |
| 218 | Event ID 218 | Operational | N |
| 219 | Event ID 219 | Operational | N |
| 220 | Event ID 220 | Operational | N |
| 221 | Event ID 221 | Operational | N |
| 222 | Event ID 222 | Operational | N |
| 223 | Event ID 223 | Operational | N |
| 224 | Event ID 224 | Operational | N |
| 225 | Event ID 225 | Operational | N |
| 226 | Event ID 226 | Operational | N |
| 227 | Event ID 227 | Operational | N |
| 228 | Event ID 228 | Operational | N |
| 229 | Event ID 229 | Operational | N |
| 230 | Event ID 230 | Operational | N |
| 231 | Event ID 231 | Operational | N |
| 232 | Event ID 232 | Operational | N |
| 233 | Event ID 233 | Operational | N |
| 234 | Event ID 234 | Operational | N |
| 235 | Event ID 235 | Operational | N |
| 236 | Event ID 236 | Operational | N |
| 237 | Event ID 237 | Operational | N |
| 238 | Event ID 238 | Operational | N |
| 239 | Event ID 239 | Operational | N |
| 240 | Event ID 240 | Operational | N |
| 241 | Event ID 241 | Operational | N |
| 242 | Event ID 242 | Operational | N |
| 243 | Event ID 243 | Operational | N |
| 244 | Event ID 244 | Operational | N |
| 245 | Event ID 245 | Operational | N |
| 246 | Event ID 246 | Operational | N |
| 247 | Event ID 247 | Operational | N |
| 248 | Event ID 248 | Operational | N |
| 249 | Event ID 249 | Operational | N |
| 250 | Event ID 250 | Operational | N |
| 251 | Event ID 251 | Operational | N |
| 252 | Event ID 252 | Operational | N |
| 253 | Event ID 253 | Operational | N |
| 254 | Event ID 254 | Operational | N |
| 255 | Event ID 255 | Operational | N |
| 256 | Event ID 256 | Operational | N |
| 257 | Event ID 257 | Operational | N |
| 258 | Event ID 258 | Operational | N |
| 259 | Event ID 259 | Operational | N |
| 260 | Event ID 260 | Operational | N |
| 261 | Event ID 261 | Operational | N |
| 262 | Event ID 262 | Operational | N |
| 263 | Event ID 263 | Operational | N |
| 264 | Event ID 264 | Operational | N |
| 265 | Event ID 265 | Operational | N |
| 266 | Event ID 266 | Operational | N |
| 267 | Event ID 267 | Operational | N |
| 268 | Event ID 268 | Operational | N |
| 269 | Event ID 269 | Operational | N |
| 270 | Event ID 270 | Operational | N |
| 271 | Event ID 271 | Operational | N |
| 272 | Event ID 272 | Operational | N |
| 273 | Event ID 273 | Operational | N |
| 274 | Event ID 274 | Operational | N |
| 275 | Event ID 275 | Operational | N |
| 276 | Event ID 276 | Operational | N |
| 277 | Event ID 277 | Operational | N |
| 278 | Event ID 278 | Operational | N |
| 279 | Event ID 279 | Operational | N |
| 280 | Event ID 280 | Operational | N |
| 281 | Event ID 281 | Operational | N |
| 282 | Event ID 282 | Operational | N |
| 283 | Event ID 283 | Operational | N |
| 284 | Event ID 284 | Operational | N |
| 285 | Event ID 285 | Operational | N |
| 286 | Event ID 286 | Operational | N |
| 287 | Event ID 287 | Operational | N |
| 288 | Event ID 288 | Operational | N |
| 289 | Event ID 289 | Operational | N |
| 290 | Event ID 290 | Operational | N |
| 291 | Event ID 291 | Operational | N |
| 292 | Event ID 292 | Operational | N |
| 293 | Event ID 293 | Operational | N |
| 294 | Event ID 294 | Operational | N |
| 295 | Event ID 295 | Operational | N |
| 296 | Event ID 296 | Operational | N |
| 297 | Event ID 297 | Operational | N |
| 298 | Event ID 298 | Operational | N |
| 299 | Event ID 299 | Operational | N |
| 300 | Event ID 300 | Operational | N |
| 301 | Event ID 301 | Operational | N |
| 302 | Event ID 302 | Operational | N |
| 303 | Event ID 303 | Operational | N |
| 304 | Event ID 304 | Operational | N |
| 305 | Event ID 305 | Operational | N |
| 306 | Event ID 306 | Operational | N |
| 307 | Event ID 307 | Operational | N |
| 308 | Event ID 308 | Operational | N |
| 309 | Event ID 309 | Operational | N |
| 310 | Event ID 310 | Operational | N |
| 311 | Event ID 311 | Operational | N |
| 312 | Event ID 312 | Operational | N |
| 313 | Event ID 313 | Operational | N |
| 314 | Event ID 314 | Operational | N |
| 315 | Event ID 315 | Operational | N |
| 316 | Event ID 316 | Operational | N |
| 317 | Event ID 317 | Operational | N |
| 318 | Event ID 318 | Operational | N |
| 319 | Event ID 319 | Operational | N |
| 320 | Event ID 320 | Operational | N |
| 321 | Event ID 321 | Operational | N |
| 322 | Event ID 322 | Operational | N |
| 323 | Event ID 323 | Operational | N |
| 324 | Event ID 324 | Operational | N |
| 325 | Event ID 325 | Operational | N |
| 326 | Event ID 326 | Operational | N |
| 327 | Event ID 327 | Operational | N |
| 328 | Event ID 328 | Operational | N |
| 329 | Event ID 329 | Operational | N |
| 330 | Event ID 330 | Operational | N |
| 331 | Event ID 331 | Operational | N |
| 332 | Event ID 332 | Operational | N |
| 333 | Event ID 333 | Operational | N |
| 334 | Event ID 334 | Operational | N |
| 335 | Event ID 335 | Operational | N |
| 336 | Event ID 336 | Operational | N |
| 337 | Event ID 337 | Operational | N |
| 338 | Event ID 338 | Operational | N |
| 339 | Event ID 339 | Operational | N |
| 340 | Event ID 340 | Operational | N |
| 341 | Event ID 341 | Operational | N |
| 342 | Event ID 342 | Operational | N |
| 343 | Event ID 343 | Operational | N |
| 344 | Event ID 344 | Operational | N |
| 345 | Event ID 345 | Operational | N |
| 346 | Event ID 346 | Operational | N |
| 347 | Event ID 347 | Operational | N |
| 348 | Event ID 348 | Operational | N |
| 349 | Event ID 349 | Operational | N |
| 350 | Event ID 350 | Operational | N |
| 351 | Event ID 351 | Operational | N |
| 352 | Event ID 352 | Operational | N |
| 353 | Event ID 353 | Operational | N |
| 354 | Event ID 354 | Operational | N |
| 355 | Event ID 355 | Operational | N |
| 356 | Event ID 356 | Operational | N |
| 357 | Event ID 357 | Operational | N |
| 358 | Event ID 358 | Operational | N |
| 359 | Event ID 359 | Operational | N |
| 360 | Event ID 360 | Operational | N |
| 361 | Event ID 361 | Operational | N |
| 362 | Event ID 362 | Operational | N |
| 363 | Event ID 363 | Operational | N |
| 364 | Event ID 364 | Operational | N |
| 365 | Event ID 365 | Operational | N |
| 366 | Event ID 366 | Operational | N |
| 367 | Event ID 367 | Operational | N |
| 368 | Event ID 368 | Operational | N |
| 369 | Event ID 369 | Operational | N |
| 370 | Event ID 370 | Operational | N |
| 371 | Event ID 371 | Operational | N |
| 372 | Event ID 372 | Operational | N |
| 373 | Event ID 373 | Operational | N |
| 374 | Event ID 374 | Operational | N |
| 375 | Event ID 375 | Operational | N |
| 376 | Event ID 376 | Operational | N |
| 377 | Event ID 377 | Operational | N |
| 378 | Event ID 378 | Operational | N |
| 379 | Event ID 379 | Operational | N |
| 380 | Event ID 380 | Operational | N |
| 381 | Event ID 381 | Operational | N |
| 382 | Event ID 382 | Operational | N |
| 383 | Event ID 383 | Operational | N |
| 384 | Event ID 384 | Operational | N |
| 385 | Event ID 385 | Operational | N |
| 386 | Event ID 386 | Operational | N |
| 387 | Event ID 387 | Operational | N |
| 388 | Event ID 388 | Operational | N |
| 389 | Event ID 389 | Operational | N |
| 390 | Event ID 390 | Operational | N |
| 391 | Event ID 391 | Operational | N |
| 392 | Event ID 392 | Operational | N |
| 393 | Event ID 393 | Operational | N |
| 394 | Event ID 394 | Operational | N |
| 395 | Event ID 395 | Operational | N |
| 396 | Event ID 396 | Operational | N |
| 397 | Event ID 397 | Operational | N |
| 398 | Event ID 398 | Operational | N |
| 399 | Event ID 399 | Operational | N |
| 400 | Event ID 400 | Operational | N |
| 401 | Event ID 401 | Operational | N |
| 402 | Event ID 402 | Operational | N |
| 403 | Event ID 403 | Operational | N |
| 404 | Event ID 404 | Operational | N |
| 405 | Event ID 405 | Operational | N |
| 406 | Event ID 406 | Operational | N |
| 407 | Event ID 407 | Operational | N |
| 408 | Event ID 408 | Operational | N |
| 409 | Event ID 409 | Operational | N |
| 410 | Event ID 410 | Operational | N |
| 411 | Event ID 411 | Operational | N |
| 412 | Event ID 412 | Operational | N |
| 413 | Event ID 413 | Operational | N |
| 414 | Event ID 414 | Operational | N |
| 415 | Event ID 415 | Operational | N |
| 416 | Event ID 416 | Operational | N |
| 417 | Event ID 417 | Operational | N |
| 418 | Event ID 418 | Operational | N |
| 419 | Event ID 419 | Operational | N |
| 420 | Event ID 420 | Operational | N |
| 421 | Event ID 421 | Operational | N |
| 422 | Event ID 422 | Operational | N |
| 423 | Event ID 423 | Operational | N |
| 424 | Event ID 424 | Operational | N |
| 425 | Event ID 425 | Operational | N |
| 426 | Event ID 426 | Operational | N |
| 427 | Event ID 427 | Operational | N |
| 428 | Event ID 428 | Operational | N |
| 429 | Event ID 429 | Operational | N |
| 430 | Event ID 430 | Operational | N |
| 431 | Event ID 431 | Operational | N |
| 432 | Event ID 432 | Operational | N |
| 433 | Event ID 433 | Operational | N |
| 434 | Event ID 434 | Operational | N |
| 435 | Event ID 435 | Operational | N |
| 436 | Event ID 436 | Operational | N |
| 437 | Event ID 437 | Operational | N |
| 438 | Event ID 438 | Operational | N |
| 439 | Event ID 439 | Operational | N |
| 440 | Event ID 440 | Operational | N |
| 441 | Event ID 441 | Operational | N |
| 442 | Event ID 442 | Operational | N |
| 443 | Event ID 443 | Operational | N |
| 444 | Event ID 444 | Operational | N |
| 445 | Event ID 445 | Operational | N |
| 446 | Event ID 446 | Operational | N |
| 447 | Event ID 447 | Operational | N |
| 448 | Event ID 448 | Operational | N |
| 449 | Event ID 449 | Operational | N |
| 450 | Event ID 450 | Operational | N |
| 451 | Event ID 451 | Operational | N |
| 452 | Event ID 452 | Operational | N |
| 453 | Event ID 453 | Operational | N |
| 454 | Event ID 454 | Operational | N |
| 455 | Event ID 455 | Operational | N |
| 456 | Event ID 456 | Operational | N |
| 457 | Event ID 457 | Operational | N |
| 458 | Event ID 458 | Operational | N |
| 459 | Event ID 459 | Operational | N |
| 460 | Event ID 460 | Operational | N |
| 461 | Event ID 461 | Operational | N |
| 462 | Event ID 462 | Operational | N |
| 463 | Event ID 463 | Operational | N |
| 464 | Event ID 464 | Operational | N |
| 465 | Event ID 465 | Operational | N |
| 466 | Event ID 466 | Operational | N |
| 467 | Event ID 467 | Operational | N |
| 468 | Event ID 468 | Operational | N |
| 469 | Event ID 469 | Operational | N |
| 470 | Event ID 470 | Operational | N |
| 471 | Event ID 471 | Operational | N |
| 472 | Event ID 472 | Operational | N |
| 473 | Event ID 473 | Operational | N |
| 474 | Event ID 474 | Operational | N |
| 475 | Event ID 475 | Operational | N |
| 476 | Event ID 476 | Operational | N |
| 477 | Event ID 477 | Operational | N |
| 478 | Event ID 478 | Operational | N |
| 479 | Event ID 479 | Operational | N |
| 480 | Event ID 480 | Operational | N |
| 481 | Event ID 481 | Operational | N |
| 482 | Event ID 482 | Operational | N |
| 483 | Event ID 483 | Operational | N |
| 484 | Event ID 484 | Operational | N |
| 485 | Event ID 485 | Operational | N |
| 486 | Event ID 486 | Operational | N |
| 487 | Event ID 487 | Operational | N |
| 488 | Event ID 488 | Operational | N |
| 489 | Event ID 489 | Operational | N |
| 490 | Event ID 490 | Operational | N |
| 491 | Event ID 491 | Operational | N |
| 492 | Event ID 492 | Operational | N |
| 493 | Event ID 493 | Operational | N |
| 494 | Event ID 494 | Operational | N |
| 495 | Event ID 495 | Operational | N |
| 496 | Event ID 496 | Operational | N |
| 497 | Event ID 497 | Operational | N |
| 498 | Event ID 498 | Operational | N |
| 499 | Event ID 499 | Operational | N |
| 500 | Event ID 500 | Operational | N |
| 501 | Event ID 501 | Operational | N |
| 502 | Event ID 502 | Operational | N |
| 503 | Event ID 503 | Operational | N |
| 504 | Event ID 504 | Operational | N |
| 505 | Event ID 505 | Operational | N |
| 506 | Event ID 506 | Operational | N |
| 507 | Event ID 507 | Operational | N |
| 508 | Event ID 508 | Operational | N |
| 509 | Event ID 509 | Operational | N |
| 510 | Event ID 510 | Operational | N |
| 511 | Event ID 511 | Operational | N |
| 512 | Event ID 512 | Operational | N |
| 513 | Event ID 513 | Operational | N |
| 514 | Event ID 514 | Operational | N |
| 515 | Event ID 515 | Operational | N |
| 516 | Event ID 516 | Operational | N |
| 517 | Event ID 517 | Operational | N |
| 518 | Event ID 518 | Operational | N |
| 519 | Event ID 519 | Operational | N |
| 520 | Event ID 520 | Operational | N |
| 521 | Event ID 521 | Operational | N |
| 522 | Event ID 522 | Operational | N |
| 523 | Event ID 523 | Operational | N |
| 524 | Event ID 524 | Operational | N |
| 525 | Event ID 525 | Operational | N |
| 526 | Event ID 526 | Operational | N |
| 527 | Event ID 527 | Operational | N |
| 528 | Event ID 528 | Operational | N |
| 529 | Event ID 529 | Operational | N |
| 530 | Event ID 530 | Operational | N |
| 531 | Event ID 531 | Operational | N |
| 532 | Event ID 532 | Operational | N |
| 533 | Event ID 533 | Operational | N |
| 534 | Event ID 534 | Operational | N |
| 535 | Event ID 535 | Operational | N |
| 536 | Event ID 536 | Operational | N |
| 537 | Event ID 537 | Operational | N |
| 538 | Event ID 538 | Operational | N |
| 539 | Event ID 539 | Operational | N |
| 540 | Event ID 540 | Operational | N |
| 541 | Event ID 541 | Operational | N |
| 542 | Event ID 542 | Operational | N |
| 543 | Event ID 543 | Operational | N |
| 544 | Event ID 544 | Operational | N |
| 545 | Event ID 545 | Operational | N |
| 546 | Event ID 546 | Operational | N |
| 547 | Event ID 547 | Operational | N |
| 548 | Event ID 548 | Operational | N |
| 549 | Event ID 549 | Operational | N |
| 550 | Event ID 550 | Operational | N |
| 551 | Event ID 551 | Operational | N |
| 552 | Event ID 552 | Operational | N |
| 553 | Event ID 553 | Operational | N |
| 554 | Event ID 554 | Operational | N |
| 555 | Event ID 555 | Operational | N |
| 556 | Event ID 556 | Operational | N |
| 557 | Event ID 557 | Operational | N |
| 558 | Event ID 558 | Operational | N |
| 559 | Event ID 559 | Operational | N |
| 560 | Event ID 560 | Operational | N |
| 561 | Event ID 561 | Operational | N |
| 562 | Event ID 562 | Operational | N |
| 563 | Event ID 563 | Operational | N |
| 564 | Event ID 564 | Operational | N |
| 565 | Event ID 565 | Operational | N |
| 566 | Event ID 566 | Operational | N |
| 567 | Event ID 567 | Operational | N |
| 568 | Event ID 568 | Operational | N |
| 569 | Event ID 569 | Operational | N |
| 570 | Event ID 570 | Operational | N |
| 571 | Event ID 571 | Operational | N |
| 572 | Event ID 572 | Operational | N |
| 573 | Event ID 573 | Operational | N |
| 574 | Event ID 574 | Operational | N |
| 575 | Event ID 575 | Operational | N |
| 576 | Event ID 576 | Operational | N |
| 577 | Event ID 577 | Operational | N |
| 578 | Event ID 578 | Operational | N |
| 579 | Event ID 579 | Operational | N |
| 580 | Event ID 580 | Operational | N |
| 581 | Event ID 581 | Operational | N |
| 582 | Event ID 582 | Operational | N |
| 583 | Event ID 583 | Operational | N |
| 584 | Event ID 584 | Operational | N |
| 585 | Event ID 585 | Operational | N |
| 586 | Event ID 586 | Operational | N |
| 587 | Event ID 587 | Operational | N |
| 588 | Event ID 588 | Operational | N |
| 589 | Event ID 589 | Operational | N |
| 590 | Event ID 590 | Operational | N |
| 591 | Event ID 591 | Operational | N |
| 592 | Event ID 592 | Operational | N |
| 593 | Event ID 593 | Operational | N |
| 594 | Event ID 594 | Operational | N |
| 595 | Event ID 595 | Operational | N |
| 596 | Event ID 596 | Operational | N |
| 597 | Event ID 597 | Operational | N |
| 598 | Event ID 598 | Operational | N |
| 599 | Event ID 599 | Operational | N |
| 600 | Event ID 600 | Operational | N |
| 601 | Event ID 601 | Operational | N |
| 602 | Event ID 602 | Operational | N |
| 603 | Event ID 603 | Operational | N |
| 604 | Event ID 604 | Operational | N |
| 605 | Event ID 605 | Operational | N |
| 606 | Event ID 606 | Operational | N |
| 607 | Event ID 607 | Operational | N |
| 608 | Event ID 608 | Operational | N |
| 609 | Event ID 609 | Operational | N |
| 610 | Event ID 610 | Operational | N |
| 611 | Event ID 611 | Operational | N |
| 612 | Event ID 612 | Operational | N |
| 613 | Event ID 613 | Operational | N |
| 614 | Event ID 614 | Operational | N |
| 615 | Event ID 615 | Operational | N |
| 616 | Event ID 616 | Operational | N |
| 617 | Event ID 617 | Operational | N |
| 618 | Event ID 618 | Operational | N |
| 619 | Event ID 619 | Operational | N |
| 620 | Event ID 620 | Operational | N |
| 621 | Event ID 621 | Operational | N |
| 622 | Event ID 622 | Operational | N |
| 623 | Event ID 623 | Operational | N |
| 624 | Event ID 624 | Operational | N |
| 625 | Event ID 625 | Operational | N |
| 626 | Event ID 626 | Operational | N |
| 627 | Event ID 627 | Operational | N |
| 628 | Event ID 628 | Operational | N |
| 629 | Event ID 629 | Operational | N |
| 630 | Event ID 630 | Operational | N |
| 631 | Event ID 631 | Operational | N |
| 632 | Event ID 632 | Operational | N |
| 633 | Event ID 633 | Operational | N |
| 634 | Event ID 634 | Operational | N |
| 635 | Event ID 635 | Operational | N |
| 636 | Event ID 636 | Operational | N |
| 637 | Event ID 637 | Operational | N |
| 638 | Event ID 638 | Operational | N |
| 639 | Event ID 639 | Operational | N |
| 640 | Event ID 640 | Operational | N |
| 641 | Event ID 641 | Operational | N |
| 642 | Event ID 642 | Operational | N |
| 643 | Event ID 643 | Operational | N |
| 644 | Event ID 644 | Operational | N |
| 645 | Event ID 645 | Operational | N |
| 646 | Event ID 646 | Operational | N |
| 647 | Event ID 647 | Operational | N |
| 648 | Event ID 648 | Operational | N |
| 649 | Event ID 649 | Operational | N |
| 650 | Event ID 650 | Operational | N |
| 651 | Event ID 651 | Operational | N |
| 652 | Event ID 652 | Operational | N |
| 653 | Event ID 653 | Operational | N |
| 654 | Event ID 654 | Operational | N |
| 655 | Event ID 655 | Operational | N |
| 656 | Event ID 656 | Operational | N |
| 657 | Event ID 657 | Operational | N |
| 658 | Event ID 658 | Operational | N |
| 659 | Event ID 659 | Operational | N |
| 660 | Event ID 660 | Operational | N |
| 661 | Event ID 661 | Operational | N |
| 662 | Event ID 662 | Operational | N |
| 663 | Event ID 663 | Operational | N |
| 664 | Event ID 664 | Operational | N |
| 665 | Event ID 665 | Operational | N |
| 666 | Event ID 666 | Operational | N |
| 667 | Event ID 667 | Operational | N |
| 668 | Event ID 668 | Operational | N |
| 669 | Event ID 669 | Operational | N |
| 670 | Event ID 670 | Operational | N |
| 671 | Event ID 671 | Operational | N |
| 672 | Event ID 672 | Operational | N |
| 673 | Event ID 673 | Operational | N |
| 674 | Event ID 674 | Operational | N |
| 675 | Event ID 675 | Operational | N |
| 676 | Event ID 676 | Operational | N |
| 677 | Event ID 677 | Operational | N |
| 678 | Event ID 678 | Operational | N |
| 679 | Event ID 679 | Operational | N |
| 680 | Event ID 680 | Operational | N |
| 681 | Event ID 681 | Operational | N |
| 682 | Event ID 682 | Operational | N |
| 683 | Event ID 683 | Operational | N |
| 684 | Event ID 684 | Operational | N |
| 685 | Event ID 685 | Operational | N |
| 686 | Event ID 686 | Operational | N |
| 687 | Event ID 687 | Operational | N |
| 688 | Event ID 688 | Operational | N |
| 689 | Event ID 689 | Operational | N |
| 690 | Event ID 690 | Operational | N |
| 691 | Event ID 691 | Operational | N |
| 692 | Event ID 692 | Operational | N |
| 693 | Event ID 693 | Operational | N |
| 694 | Event ID 694 | Operational | N |
| 695 | Event ID 695 | Operational | N |
| 696 | Event ID 696 | Operational | N |
| 697 | Event ID 697 | Operational | N |
| 698 | Event ID 698 | Operational | N |
| 699 | Event ID 699 | Operational | N |
| 700 | Event ID 700 | Operational | N |
| 701 | Event ID 701 | Operational | N |
| 702 | Event ID 702 | Operational | N |
| 703 | Event ID 703 | Operational | N |
| 704 | Event ID 704 | Operational | N |
| 705 | Event ID 705 | Operational | N |
| 706 | Event ID 706 | Operational | N |
| 707 | Event ID 707 | Operational | N |
| 708 | Event ID 708 | Operational | N |
| 709 | Event ID 709 | Operational | N |
| 710 | Event ID 710 | Operational | N |
| 711 | Event ID 711 | Operational | N |
| 712 | Event ID 712 | Operational | N |
| 713 | Event ID 713 | Operational | N |
| 714 | Event ID 714 | Operational | N |
| 715 | Event ID 715 | Operational | N |
| 716 | Event ID 716 | Operational | N |
| 717 | Event ID 717 | Operational | N |
Event ID 10
#Fields #
| Name | Description |
|---|---|
A10_Vcn HexInt64 | |
A11_AttributeFormNonresidentLowestVcn HexInt64 | |
A12_AttributeFormNonresidentHighestVcn HexInt64 | |
A13_AllocationClusters HexInt64 |
Event ID 12
#Fields #
| Name | Description |
|---|---|
A10_FileObject Pointer | |
A11_Scb Pointer | |
A12_StartingVcn HexInt64 | |
A13_ClusterCount HexInt64 | |
A14_Flags HexInt32 | |
A15_CcbForWriteExtend Pointer |
Event ID 13
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_FileObject Pointer | |
A12_Scb Pointer | |
A13_StartingVcn HexInt64 | |
A14_ClusterCount HexInt64 | |
A15_Flags HexInt32 | |
A16_CcbForWriteExtend Pointer |
Event ID 15
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_PurgeOffset HexInt64 | |
A12_PurgeChunkLength HexInt32 |
Event ID 16
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_LastVcn HexInt64 | |
A12_AttributeInstance HexInt32 |
Event ID 19
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_ValueLength HexInt32 | |
A12_AttributeFlags HexInt32 |
Event ID 20
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_LastVcn HexInt64 | |
A15_NewHighestVcn HexInt64 | |
A16_PassCount HexInt32 |
Event ID 21
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_ContextFoundAttributeAttributeFormNonresidentLowestVcn HexInt64 | |
A15_ContextFoundAttributeAttributeFormNonresidentHighestVcn HexInt64 | |
A16_ContextAttributeListEntryLowestVcn HexInt64 |
Event ID 22
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_ContextFoundAttributeAttributeFormNonresidentLowestVcn HexInt64 | |
A15_ContextFoundAttributeAttributeFormNonresidentHighestVcn HexInt64 | |
A16_ContextAttributeListEntryLowestVcn HexInt64 |
Event ID 23
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_ContextFoundAttributeAttributeFormNonresidentLowestVcn HexInt64 | |
A15_ContextFoundAttributeAttributeFormNonresidentHighestVcn HexInt64 | |
A16_ContextAttributeListEntryLowestVcn HexInt64 | |
A17_PassCount HexInt32 |
Event ID 24
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_ContextFoundAttributeAttributeFormNonresidentLowestVcn HexInt64 | |
A15_ContextFoundAttributeAttributeFormNonresidentHighestVcn HexInt64 | |
A16_ContextAttributeListEntryLowestVcn HexInt64 |
Event ID 25
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_NtfsFrsConsolidationStatisticsMergeSkipCount HexInt32 |
Event ID 26
#Fields #
| Name | Description |
|---|---|
A10_FileRecordSegmentNumberHighPart HexInt32 | |
A11_FileRecordSegmentNumberLowPart HexInt32 | |
A12_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 | |
A13_AttributeTypeCode HexInt32 |
Event ID 27
#Fields #
| Name | Description |
|---|---|
A10_FileRecordSegmentNumberHighPart HexInt32 | |
A11_FileRecordSegmentNumberLowPart HexInt32 | |
A12_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 | |
A13_AttributeTypeCode HexInt32 |
Event ID 28
#Fields #
| Name | Description |
|---|---|
A10_FcbVcb Pointer | |
A11_IrpContext Pointer | |
A12_PULONGLONG_FcbFileReference HexInt64 | |
A13_StdInfoAttrListEntrySignature HexInt32 | |
A14_StdInfoAttrListEntryLastCompactedSize HexInt32 | |
A15_CurrentAttributeListSize HexInt32 |
Event ID 29
#Fields #
| Name | Description |
|---|---|
A10_FcbVcb Pointer | |
A11_IrpContext Pointer | |
A12_PULONGLONG_FcbFileReference HexInt64 | |
A13_StdInfoAttrListEntrySignature HexInt32 | |
A14_StdInfoAttrListEntryLastCompactedSize HexInt32 | |
A15_NewStdInfoAttrListEntryLastCompactedSize HexInt32 |
Event ID 30
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_i HexInt32 | |
A12_MAX_MOVEABLE_ATTRIBUTES HexInt32 | |
A13_AttributeTypeCode HexInt32 | |
A14_AttributeRecordLength HexInt32 | |
A15_AttributeInstance HexInt32 |
Event ID 31
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_SizeNeeded HexInt32 | |
A12_AttributeTypeCode HexInt32 | |
A13_AttributeRecordLength HexInt32 | |
A14_AttributeFormCode HexInt32 | |
A15_AttributeInstance HexInt32 |
Event ID 32
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_SizeNeeded HexInt32 | |
A12_BytesToFree HexInt32 | |
A13_MappingPairSize HexInt32 | |
A14_NewMappingPairSize HexInt32 |
Event ID 33
#Fields #
| Name | Description |
|---|---|
A10_FileRecordSegmentNumberHighPart HexInt32 | |
A11_FileRecordSegmentNumberLowPart HexInt32 | |
A12_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 | |
A13_StartZero HexInt32 | |
A14_ZeroLength HexInt32 |
Event ID 34
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_ScbAttributeTypeCode HexInt32 | |
A15__ScbAttributeName CountedUtf16String | |
A16_NewStartVcn HexInt64 | |
A17_NewHalfWayVcn HexInt64 | |
A18_NewFinalVcn HexInt64 | |
A19_PackedMode HexInt32 | |
A20_TryPrior HexInt32 |
Event ID 35
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_ScbAttributeTypeCode HexInt32 | |
A15__ScbAttributeName CountedUtf16String | |
A16_FileRecordSequenceNumber HexInt32 | |
A17_FileRecordSegmentNumberLowPart HexInt32 | |
A18_NewStartVcn HexInt64 | |
A19_LastVcn HexInt64 | |
A20_NewFinalVcn HexInt64 |
Event ID 36
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_ScbAttributeTypeCode HexInt32 | |
A15__ScbAttributeName CountedUtf16String | |
A16_FileRecordSequenceNumber HexInt32 | |
A17_FileRecordSegmentNumberLowPart HexInt32 | |
A18_NewStartVcn HexInt64 | |
A19_LastVcn HexInt64 | |
A20_NewFinalVcn HexInt64 |
Event ID 37
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_NewFinalVcn HexInt64 |
Event ID 38
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_NewHalfWayVcn HexInt64 | |
A15_RangePtr Pointer |
Event ID 39
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_NewHalfWayVcn HexInt64 | |
A15_RangePtr Pointer |
Event ID 40
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_NtfsMcbArray Pointer | |
A15_NtfsMcbArrayStartingVcn HexInt64 | |
A16_NtfsMcbArrayEndingVcn HexInt64 |
Event ID 41
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_NtfsMcbArray Pointer | |
A15_NtfsMcbArrayStartingVcn HexInt64 | |
A16_NtfsMcbArrayEndingVcn HexInt64 |
Event ID 42
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_NtfsMcbArray Pointer | |
A15_NtfsMcbArrayStartingVcn HexInt64 | |
A16_NtfsMcbArrayEndingVcn HexInt64 |
Event ID 43
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_NtfsMcbArray Pointer | |
A15_NtfsMcbArrayStartingVcn HexInt64 | |
A16_NtfsMcbArrayEndingVcn HexInt64 |
Event ID 44
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_NewFinalVcnInMcb HexInt64 | |
A15_NewFinalVcn HexInt64 |
Event ID 45
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_NewStartVcn HexInt64 | |
A15_LastVcn HexInt64 | |
A16_NewFinalVcn HexInt64 | |
A17_NewFinalVcnInMcb HexInt64 | |
A18_NumberOfRanges HexInt32 | |
A19_DeletedNextAttribute HexInt32 | |
A20_Mcb1StartWithNewStartVcn HexInt32 | |
A21_Mcb1HoldNewStartVcn HexInt32 | |
A22_Mcb2StartWithNewStartVcn HexInt32 | |
A23_Mcb2HoldNewStartVcn HexInt32 | |
A24_McbArraySizeInUseChange Int32 |
Event ID 46
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_NewStartVcn HexInt64 | |
A15_DeletedNextAttributeNewFinalVcnInMcbLastVcn1 HexInt64 |
Event ID 47
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_LastVcn HexInt64 | |
A15_NewFinalVcnInMcb HexInt64 |
Event ID 48
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_ScbAttributeTypeCode HexInt32 | |
A15__ScbAttributeName CountedUtf16String | |
A16_PULONGLONG_ContextAttributeListEntrySegmentReference HexInt64 | |
A17_OldLowestVcn HexInt64 | |
A18_StartVcn HexInt64 | |
A19_NewAttributeInstance HexInt32 |
Event ID 49
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_ScbAttributeTypeCode HexInt32 | |
A15__ScbAttributeName CountedUtf16String | |
A16_OldLowestVcn HexInt64 | |
A17_StartVcn HexInt64 | |
A18_OldHighestVcn HexInt64 | |
A19_LastVcn HexInt64 | |
A20_FileRecordSequenceNumber HexInt32 | |
A21_FileRecordSegmentNumberLowPart HexInt32 |
Event ID 51
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14__VolumeId CountedUtf16String | |
A15_VcbVcbState HexInt32 |
Event ID 52
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_PULONGLONG_FcbFileReference HexInt64 | |
A14_AllFlagsFirstRequest HexInt32 |
Event ID 53
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_PULONGLONG_FcbFileReference HexInt64 |
Event ID 54
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_PULONGLONG_FcbFileReference HexInt64 |
Event ID 55
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_PULONGLONG_FcbFileReference HexInt64 | |
A14_FrsConsolidationContextRestartAttributeTypeCode HexInt32 | |
A15__FrsConsolidationContextRestartAttributeName CountedUtf16String | |
A16_FrsConsolidationContextRestartVcn HexInt64 | |
A17_FrsConsolidationContextRestartAttributeListEntryOffset HexInt32 | |
A18_AttributeListEntryOffset HexInt32 | |
A19_AttrContextAttributeListAttributeListFormNonresidentValidDataLength HexInt64 | |
A20_AttributeListGrowBy HexInt32 | |
A21_AttributeListGrowBy Int32 |
Event ID 56
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_PULONGLONG_FcbFileReference HexInt64 | |
A14_FrsConsolidationContextRestartAttributeTypeCode HexInt32 | |
A15__FrsConsolidationContextRestartAttributeName CountedUtf16String | |
A16_FrsConsolidationContextRestartVcn HexInt64 | |
A17_FrsConsolidationContextInstance HexInt32 | |
A18_FrsConsolidationContextRestartAttributeListEntryOffset HexInt32 | |
A19_AttrContextAttributeListAttributeListFormNonresidentValidDataLength HexInt64 |
Event ID 57
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_PULONGLONG_FcbFileReference HexInt64 | |
A14_FrsConsolidationContextRestartAttributeTypeCode HexInt32 | |
A15__FrsConsolidationContextRestartAttributeName CountedUtf16String | |
A16_FrsConsolidationContextRestartVcn HexInt64 | |
A17_FrsConsolidationContextInstance HexInt32 | |
A18_FrsConsolidationContextRestartAttributeListEntryOffset HexInt32 | |
A19_AttrContextAttributeListAttributeListFormNonresidentValidDataLength HexInt64 |
Event ID 58
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_PULONGLONG_FcbFileReference HexInt64 | |
A14_Scb Pointer |
Event ID 59
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_PULONGLONG_FcbFileReference HexInt64 |
Event ID 60
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_PULONGLONG_FrsConsolidationContextFileReference HexInt64 | |
A13_IrpContextExceptionStatus HexInt32 |
Event ID 61
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_PULONGLONG_FcbFileReference HexInt64 |
Event ID 62
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_PULONGLONG_FcbFileReference HexInt64 |
Event ID 63
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_FileRef HexInt64 | |
A14_ExceptionStatus HexInt32 |
Event ID 64
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_FileRef HexInt64 | |
A14_RemovedFcb HexInt32 | |
A15_AllFlagsFcbAcquired HexInt32 | |
A16_IrpContextTransactionId HexInt32 |
Event ID 65
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_EndTimeQuadPart1000NtfsPerformanceFrequencyQuadPart Int64 | |
A13_FrsConsolidationContextTotalTime1000NtfsPerformanceFrequencyQuadPart Int64 |
Event ID 66
#Fields #
| Name | Description |
|---|---|
A10_FcbVcb Pointer | |
A11_IrpContext Pointer | |
A12_PULONGLONG_FcbFileReference HexInt64 | |
A13_StdInfoAttrListEntrySignature HexInt32 | |
A14_StdInfoAttrListEntryLastCompactedSize HexInt32 | |
A15_AttributeListSize HexInt32 |
Event ID 67
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12_Scb Pointer | |
A13__ScbMcb Pointer | |
A14_OriginalStartingVcn HexInt64 | |
A15_ClusterCount HexInt64 | |
A16_AllocateAll UInt32 | |
A17_TargetLcnNULLTargetLcnULONGLONG1 HexInt64 | |
A18_PreAllocated UInt32 | |
A19_UseDelayedAllocation UInt32 |
Event ID 68
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12_Scb Pointer | |
A13__ScbMcb Pointer | |
A14_OriginalStartingVcn HexInt64 | |
A15_ClusterCount HexInt64 | |
A16_AllocateAll UInt32 | |
A17_TargetLcnNULLTargetLcnULONGLONG1 HexInt64 | |
A18_PreAllocated UInt32 | |
A19_UseDelayedAllocation UInt32 |
Event ID 69
#Fields #
| Name | Description |
|---|---|
A10_FoundClusterCount HexInt64 | |
A11_Scb Pointer | |
A12_ScbTotalAllocated HexInt64 |
Event ID 70
#Fields #
| Name | Description |
|---|---|
A10_FoundClusterCount HexInt64 | |
A11_Scb Pointer | |
A12_ScbTotalAllocated HexInt64 | |
A13_ScbState HexInt32 | |
A14_IrpContextState2 HexInt32 | |
A15_AllocateWithNoHole Int32 |
Event ID 73
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12_Scb Pointer | |
A13__ScbMcb Pointer | |
A14_StartingVcn HexInt64 | |
A15_EndingVcn HexInt64 |
Event ID 74
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_PULONGLONG_ScbFcbFileReference HexInt64 | |
A12_StartingVcn HexInt64 | |
A13_EndingVcn HexInt64 |
Event ID 75
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12_Scb Pointer | |
A13__ScbMcb Pointer | |
A14_StartingVcn HexInt64 | |
A15_EndingVcn HexInt64 |
Event ID 76
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_PULONGLONG_ScbFcbFileReference HexInt64 | |
A12_AdjLcn HexInt64 | |
A13_AdjClusterCount HexInt64 |
Event ID 78
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_DeallocatedClusters Pointer | |
A12_DeallocatedClustersLsnQuadPart HexInt64 | |
A13_DeallocatedClustersClusterCount HexInt64 | |
A14_DeallocatedClustersFlags HexInt32 | |
A15_VcbDeallocatedClusters HexInt64 | |
A16_VcbDeallocatedClustersAdjClusterCount HexInt64 |
Event ID 79
#Fields #
| Name | Description |
|---|---|
A10_ClusterCount HexInt64 | |
A11_Scb Pointer | |
A12_TotalAllocated HexInt64 | |
A13_TotalAllocated Pointer |
Event ID 80
#Fields #
| Name | Description |
|---|---|
A10_ClusterCount HexInt64 | |
A11_Scb Pointer | |
A12_TotalAllocated Pointer | |
A13_ScbState HexInt32 | |
A14_IrpContextState2 HexInt32 |
Event ID 81
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_VcbDeallocatedClusters HexInt64 | |
A12_VcbDeallocatedClustersClustersRemoved HexInt64 |
Event ID 84
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12_FirstBit HexInt64 | |
A13_BeyondFinalBit HexInt64 | |
A14_RedoOperation HexInt32 | |
A15_UndoOperation HexInt32 |
Event ID 85
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11__Bitmap Pointer | |
A12_BaseLcn HexInt64 | |
A13_CurrentLcn HexInt64 |
Event ID 86
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12_StartingLcn HexInt64 | |
A13_ClusterCount HexInt64 |
Event ID 87
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11__Bitmap Pointer | |
A12_BaseLcn HexInt64 | |
A13_StartingLcn HexInt64 |
Event ID 88
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Bitmap Pointer | |
A12_BitMapOffset HexInt32 | |
A13_NumberOfBits HexInt32 |
Event ID 89
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12_StartingLcn HexInt64 | |
A13_ClusterCount HexInt64 |
Event ID 90
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11__Bitmap Pointer | |
A12_BaseLcn HexInt64 | |
A13_StartingLcn HexInt64 |
Event ID 91
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Bitmap Pointer | |
A12_BitMapOffset HexInt32 | |
A13_NumberOfBits HexInt32 |
Event ID 92
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12_Bitmap Pointer | |
A13_StartingBitmapLcn HexInt64 | |
A14_SetBits UInt32 |
Event ID 93
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Bitmap Pointer | |
A12_StartingBit HexInt64 | |
A13_EndingBit HexInt64 |
Event ID 95
#Fields #
| Name | Description |
|---|---|
A10_i HexInt32 | |
A11_OriginalSystemBitmapisizeofOriginalSystemBitmap0 HexInt32 |
Event ID 96
#Event ID 97
#Fields #
| Name | Description |
|---|---|
A10_Length Int64 | |
A11_BinIndex UInt32 | |
A12_Key UInt32 | |
A13_BitPosition Int32 | |
A14_GroupIndex Int32 | |
A15_GroupShiftFactor Int32 |
Event ID 100
#Fields #
| Name | Description |
|---|---|
A10_BinIndex UInt32 | |
A11_MaxLength Int64 | |
A12_GroupIndex Int32 | |
A13_RelativeBinIndex Int32 | |
A14_MaxKey UInt32 |
Event ID 101
#Fields #
| Name | Description |
|---|---|
A10_NtfsCachedRunBinGroupShift Int32 | |
A11_NtfsCachedRunBinGroupSize UInt32 | |
A12_NtfsCachedRunBinGroupMask HexInt32 |
Event ID 103
#Fields #
| Name | Description |
|---|---|
A10_StartingCluster HexInt64 | |
A11_ClusterCount HexInt64 | |
A12_VcbTotalClustersCommitted HexInt64 | |
A13_VcbTotalClusters HexInt64 | |
A14_VcbFreeClusters HexInt64 |
Event ID 104
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_FirstBitToClear HexInt32 | |
A12_BeyondLastBitToClear1 HexInt32 |
Event ID 106
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_FreeClusterBase1 HexInt64 | |
A12_FreeClusterCount1 HexInt64 |
Event ID 108
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_FreeClusterBase2 HexInt64 | |
A12_FreeClusterCount2 HexInt64 |
Event ID 109
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_PsGetCurrentThread Pointer | |
A12_VcbTotalClustersCommitted HexInt64 | |
A13_VcbTotalClusters HexInt64 | |
A14_VcbTPMapSizeOfBitMap HexInt32 |
Event ID 111
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_StartingZero HexInt64 | |
A12_ByteCount HexInt64 | |
A13_ExtentsDescriptor Pointer | |
A14_ExtentsDescriptorIndex Int32 | |
A15_ExtentsDescriptorStartOffset HexInt64 | |
A16_Offset HexInt64 | |
A17_MaxRuns Int32 |
Event ID 112
#Fields #
| Name | Description |
|---|---|
A10_RunIndex Int32 | |
A11_ExtentsDescriptorRunRunIndexBasePage HexInt64 | |
A12_ExtentsDescriptorRunRunIndexPageCount HexInt64 | |
A13_ExtentLength HexInt64 | |
A14_Offset HexInt64 | |
A15_RunIndexStartOffset HexInt64 |
Event ID 113
#Event ID 115
#Fields #
| Name | Description |
|---|---|
A10_StartingPhysicalAddrQuadPart HexInt64 | |
A11_LengthInExtent HexInt64 |
Event ID 116
#Fields #
| Name | Description |
|---|---|
A10_ExtentsDescriptorIndex Int32 | |
A11_ExtentsDescriptorStartOffset HexInt64 |
Event ID 117
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_StartingOffset HexInt64 | |
A12_BeyondEndOffset HexInt64 |
Event ID 118
#Fields #
| Name | Description |
|---|---|
A10_DataSetRangeIndex Int32 | |
A11_DsmBufferDataSetRangesDataSetRangeIndexStartingOffset HexInt64 | |
A12_DsmBufferDataSetRangesDataSetRangeIndexLengthInBytes HexInt64 |
Event ID 120
#Fields #
| Name | Description |
|---|---|
A10_DsmByteAddressRangesTotalNumberOfRanges Int32 | |
A11_DsmByteAddressRangesNumberOfRangesReturned Int32 |
Event ID 121
#Fields #
| Name | Description |
|---|---|
A10_Index Int32 | |
A11_DsmByteAddressRangesRangesIndexStartAddress HexInt64 | |
A12_DsmByteAddressRangesRangesIndexLengthInBytes HexInt64 |
Event ID 122
#Fields #
| Name | Description |
|---|---|
A10_StartingPhysicalAddrQuadPart HexInt64 | |
A11_LengthInExtent HexInt64 |
Event ID 123
#Fields #
| Name | Description |
|---|---|
A10_ExtentsDescriptorIndex Int32 | |
A11_ExtentsDescriptorStartOffset HexInt64 |
Event ID 124
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_StartingZero HexInt64 | |
A12_BeyondEndOffset HexInt64 | |
A13_ByteCount HexInt64 | |
A14_ExtentsDescriptor Pointer | |
A15_ExtentsDescriptorIndexExtentsDescriptorIndex0 Int32 | |
A16_ExtentsDescriptorStartOffsetExtentsDescriptorStartOffset0 HexInt64 |
Event ID 125
#Fields #
| Name | Description |
|---|---|
A10_ExtentsDescriptorIndex Int32 | |
A11_ExtentsDescriptorStartOffset HexInt64 |
Event ID 126
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Scb Pointer | |
A12_StartOffset HexInt64 | |
A13_ByteCount HexInt32 |
Event ID 132
#Fields #
| Name | Description |
|---|---|
A10_Irp Pointer | |
A11_IrpContext Pointer | |
A12_Vcb Pointer | |
A13_CreateContextFileObject Pointer | |
A14_CreateContextFileObjectRelatedFileObject Pointer | |
A15__CreateContextFileObjectFileName 25 | |
A16_CreateContextIrpSpParametersCreateOptions HexInt32 | |
A17_CreateContextIrpSpParametersCreateFileAttributes HexInt32 | |
A18_CreateContextDesiredAccess HexInt32 | |
A19_CreateContextIrpSpParametersCreateShareAccess HexInt32 | |
A20_CreateContextIrpSpParametersCreateEaLength HexInt32 |
Event ID 133
#Fields #
| Name | Description |
|---|---|
A10_Irp Pointer | |
A11_IrpContext Pointer | |
A12_Vcb Pointer | |
A13_CreateContextFileObject Pointer | |
A14_CreateContextFileObjectRelatedFileObject Pointer | |
A15__CreateContextFileObjectFileName CountedUtf16String | |
A16_CreateContextIrpSpParametersCreateOptions HexInt32 | |
A17_CreateContextIrpSpParametersCreateFileAttributes HexInt32 | |
A18_CreateContextDesiredAccess HexInt32 | |
A19_CreateContextIrpSpParametersCreateShareAccess HexInt32 | |
A20_CreateContextIrpSpParametersCreateEaLength HexInt32 |
Event ID 134
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbVcbState HexInt32 |
Event ID 136
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbVcbState HexInt32 |
Event ID 137
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_IrpSpParametersCreateShareAccess HexInt32 | |
A15_ReadULongNoFence_VcbCleanupCount Int32 | |
A16_BiasedCleanupCount Int32 |
Event ID 138
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbVcbState HexInt32 |
Event ID 139
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_IrpSpParametersCreateShareAccess HexInt32 | |
A15_VcbReadOnlyCloseCount Int32 | |
A16_VcbCloseCount Int32 | |
A17_VcbSystemFileCloseCount Int32 |
Event ID 140
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_FcbCleanupCount Int32 | |
A17_FcbFcbState HexInt32 | |
A18_IrpSpFlags HexInt32 |
Event ID 141
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_FcbFcbState HexInt32 | |
A17_IrpSpFlags HexInt32 |
Event ID 142
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_IrpContextState HexInt32 | |
A17_IrpSpFlags HexInt32 |
Event ID 143
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisFcbFcbState HexInt32 | |
A17_CreateContextIrpSpParametersCreateOptions24_0x000000ff HexInt32 | |
A18_CreateContextIrpSpParametersCreateSecurityContextDesiredAccess HexInt32 |
Event ID 144
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_CreateContextCurrentFcbVcb Pointer | |
A12__CreateContextCurrentFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWCreateContextCurrentFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHCreateContextCurrentFcbVcbVpb CountedUtf16String | |
A14_CreateContextCurrentFcb Pointer | |
A15_NtfsFullFileRefNumber_CreateContextCurrentFcbFileReference HexInt64 | |
A16_CreateContextCurrentFcbInfoFileAttributes HexInt32 | |
A17_CreateContextCurrentFcbTxfRmcbRmState HexInt32 |
Event ID 145
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_CreateContextCurrentFcbVcb Pointer | |
A12__CreateContextCurrentFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWCreateContextCurrentFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHCreateContextCurrentFcbVcbVpb CountedUtf16String | |
A14_CreateContextCurrentFcb Pointer | |
A15_NtfsFullFileRefNumber_CreateContextCurrentFcbFileReference HexInt64 | |
A16_CreateContextCurrentFcbFcbState HexInt32 | |
A17_CreateContextIrpSpParametersCreateOptions24_0x000000ff HexInt32 | |
A18_CreateContextIrpSpParametersCreateSecurityContextDesiredAccess HexInt32 |
Event ID 146
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisFcbFcbState HexInt32 |
Event ID 147
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisFcbFcbState HexInt32 | |
A17_CreateContextIrpSpParametersCreateOptions24_0x000000ff HexInt32 | |
A18_CreateContextIrpSpParametersCreateSecurityContextDesiredAccess HexInt32 |
Event ID 148
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisFcbTxfRmcbRmState HexInt32 |
Event ID 149
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ParentScbFcbVcb Pointer | |
A12__ParentScbFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWParentScbFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHParentScbFcbVcbVpb CountedUtf16String | |
A14_ParentScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ParentScbFcbFileReference HexInt64 | |
A16_ParentScbFcbFcbState HexInt32 | |
A17_ParentScbFcbTxfRmcbRmState HexInt32 | |
A18_AttrTypeCode HexInt32 |
Event ID 150
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_CreateContextIrpSpParametersCreateOptions HexInt32 | |
A17_CcbFlags HexInt32 |
Event ID 151
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ParentScbVcb Pointer | |
A12__ParentScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWParentScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHParentScbVcbVpb CountedUtf16String | |
A14_ParentScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ParentScbFcbFileReference HexInt64 | |
A16_ParentScbFcbFcbState HexInt32 | |
A17_ParentScbFcbTxfRmcbRmState HexInt32 |
Event ID 152
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisFcbTxfRmcbRmState HexInt32 |
Event ID 153
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisEaInformationNeedEaCount Int32 | |
A17_CreateContextIrpSpParametersCreateOptions HexInt32 | |
A18_CcbFlags HexInt32 |
Event ID 154
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_AttrTypeCode HexInt32 | |
A17_CreateDisposition HexInt32 |
Event ID 155
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_CreateDisposition HexInt32 |
Event ID 156
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisFcbFcbState HexInt32 | |
A17_AttrTypeCode HexInt32 |
Event ID 157
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisFcbInfoFileAttributes HexInt32 | |
A17_FileAttributes HexInt32 |
Event ID 158
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_CreateContextIrpSpParametersCreateOptions HexInt32 |
Event ID 159
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_CreateContextThisScbAttributeTypeCode HexInt32 | |
A17_CreateContextThisScbState HexInt32 | |
A18_CreateContextThisScbScbTypeDataHighWaterMark Int64 |
Event ID 160
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_AttrCode HexInt32 | |
A15_CreateDisposition HexInt32 |
Event ID 161
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_AttrCode HexInt32 | |
A15_IrpSpParametersCreateSecurityContextAccessStateOriginalDesiredAccess HexInt32 |
Event ID 163
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisScbVcb Pointer | |
A12__ThisScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisScbVcbVpb CountedUtf16String | |
A14_ThisScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisScbFcbFileReference HexInt64 | |
A16_ThisScb Pointer | |
A17_ThisScbAttributeTypeCode HexInt32 | |
A18__ThisScbAttributeName CountedUtf16String | |
A19_IrpSpParametersCreateShareAccess HexInt32 | |
A20_IrpSpParametersCreateSecurityContextAccessStatePreviouslyGrantedAccess HexInt32 |
Event ID 164
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisScbVcb Pointer | |
A12__ThisScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisScbVcbVpb CountedUtf16String | |
A14_ThisScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisScbFcbFileReference HexInt64 | |
A16_ThisScb Pointer | |
A17_ThisScbAttributeTypeCode HexInt32 | |
A18__ThisScbAttributeName CountedUtf16String |
Event ID 165
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisScbVcb Pointer | |
A12__ThisScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisScbVcbVpb CountedUtf16String | |
A14_ThisScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisScbFcbFileReference HexInt64 | |
A16_ThisScb Pointer | |
A17_ThisScbAttributeTypeCode HexInt32 | |
A18__ThisScbAttributeName CountedUtf16String | |
A19_IrpSpParametersCreateSecurityContextAccessStatePreviouslyGrantedAccess HexInt32 |
Event ID 166
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisScbVcb Pointer | |
A12__ThisScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisScbVcbVpb CountedUtf16String | |
A14_ThisScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisScbFcbFileReference HexInt64 | |
A16_ThisScb Pointer | |
A17_ThisScbMarkHandleDisallowWritesCount Int32 | |
A18_IrpSpParametersCreateSecurityContextDesiredAccess HexInt32 |
Event ID 167
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisScbVcb Pointer | |
A12__ThisScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisScbVcbVpb CountedUtf16String | |
A14_ThisScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisScbFcbFileReference HexInt64 | |
A16_ThisScb Pointer | |
A17_ThisScbAttributeTypeCode HexInt32 | |
A18__ThisScbAttributeName CountedUtf16String | |
A19_IrpSpParametersCreateShareAccess HexInt32 | |
A20_GrantedAccess HexInt32 |
Event ID 168
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisScbVcb Pointer | |
A12__ThisScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisScbVcbVpb CountedUtf16String | |
A14_ThisScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisScbFcbFileReference HexInt64 | |
A16_IrpSpParametersCreateShareAccess HexInt32 | |
A17_IrpSpFileObjectFlags HexInt32 |
Event ID 169
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisScbVcb Pointer | |
A12__ThisScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisScbVcbVpb CountedUtf16String | |
A14_ThisScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisScbFcbFileReference HexInt64 | |
A16_ThisScb Pointer | |
A17_ThisScbAttributeTypeCode HexInt32 | |
A18__ThisScbAttributeName CountedUtf16String | |
A19_IrpSpParametersCreateShareAccess HexInt32 | |
A20_GrantedAccess HexInt32 |
Event ID 170
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_IrpSpParametersCreateShareAccess HexInt32 | |
A17_IrpSpFileObjectFlags HexInt32 |
Event ID 171
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_IrpSpParametersCreateSecurityContextDesiredAccess HexInt32 | |
A17_ThisFcbInfoFileAttributes HexInt32 | |
A18_IrpSpFlags HexInt32 |
Event ID 172
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_CurrentFcbVcb Pointer | |
A12__CurrentFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWCurrentFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHCurrentFcbVcbVpb CountedUtf16String | |
A14_CurrentFcb Pointer | |
A15_NtfsFullFileRefNumber_CurrentFcbFileReference HexInt64 | |
A16_CurrentFcbInfoFileAttributes HexInt32 | |
A17_NtfsDataFlags HexInt32 |
Event ID 173
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_CurrentFcbVcb Pointer | |
A12__CurrentFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWCurrentFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHCurrentFcbVcbVpb CountedUtf16String | |
A14_CurrentFcb Pointer | |
A15_NtfsFullFileRefNumber_CurrentFcbFileReference HexInt64 | |
A16_CurrentFcbInfoFileAttributes HexInt32 | |
A17_ThisScbAttributeFlags HexInt32 |
Event ID 174
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisScbVcb Pointer | |
A12__ThisScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisScbVcbVpb CountedUtf16String | |
A14_ThisScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisScbFcbFileReference HexInt64 | |
A16_CreateContextCurrentFcbCleanupCount Int32 | |
A17_NtfsDataEncryptionCallBackTableImplementationFlags HexInt32 |
Event ID 175
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_CurrentFcb Pointer | |
A12_NtfsFullFileRefNumber_CurrentFcbFileReference HexInt64 | |
A13_CurrentFcbTxfRmcbRmState HexInt32 |
Event ID 176
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_LcbFcbVcb Pointer | |
A12__LcbFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWLcbFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHLcbFcbVcbVpb CountedUtf16String | |
A14_LcbFcb Pointer | |
A15_NtfsFullFileRefNumber_LcbFcbFileReference HexInt64 | |
A16_WppCountedStringWLcbFileNameAttrFileNameUSHORTLcbFileNameAttrFileNameLength CountedUtf16String | |
A17_DesiredAccess HexInt32 | |
A18_DesiredShareAccess HexInt32 | |
A19_IoShareAccessFlags HexInt32 | |
A20_LinkShareAccessOpenCount Int32 | |
A21_LinkShareAccessDeleters Int32 | |
A22_LinkShareAccessSharedDelete Int32 |
Event ID 177
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_ScbAttributeTypeCode HexInt32 | |
A17__ScbAttributeName CountedUtf16String | |
A18_DesiredAccess HexInt32 | |
A19_DesiredShareAccess HexInt32 | |
A20_IoShareAccessFlags HexInt32 | |
A21_ShareAccessOpenCount Int32 | |
A22_ShareAccessReaders Int32 | |
A23_ShareAccessWriters Int32 | |
A24_ShareAccessDeleters Int32 | |
A25_ShareAccessSharedRead Int32 | |
A26_ShareAccessSharedWrite Int32 | |
A27_ShareAccessSharedDelete Int32 |
Event ID 178
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_ScbAttributeTypeCode HexInt32 | |
A17__ScbAttributeName CountedUtf16String | |
A18_WppCountedStringWLcbFileNameAttrFileNameUSHORTLcbFileNameAttrFileNameLength CountedUtf16String | |
A19_DesiredAccess HexInt32 | |
A20_DesiredShareAccess HexInt32 | |
A21_IoShareAccessFlags HexInt32 | |
A22_ShareAccessOpenCount Int32 | |
A23_ShareAccessReaders Int32 | |
A24_ShareAccessWriters Int32 | |
A25_ShareAccessDeleters Int32 | |
A26_ShareAccessSharedRead Int32 | |
A27_ShareAccessSharedWrite Int32 | |
A28_ShareAccessSharedDelete Int32 | |
A29_LinkShareAccessOpenCount Int32 | |
A30_LinkShareAccessDeleters Int32 | |
A31_LinkShareAccessSharedDelete Int32 |
Event ID 179
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_ScbAttributeTypeCode HexInt32 | |
A17__ScbAttributeName CountedUtf16String | |
A18_ARGUMENT_PRESENTLcbWppCountedStringWLcbFileNameAttrFileNameUSHORTLcbFileNameAttrFileNameLengthWppCountedStringWNULL0 CountedUtf16String | |
A19_AccessStatePreviouslyGrantedAccess HexInt32 | |
A20_AccessStateFlags HexInt32 | |
A21_DesiredShareAccess HexInt32 | |
A22_CreateDisposition HexInt32 | |
A23_ScbShareAccessOpenCount Int32 | |
A24_ScbShareAccessReaders Int32 | |
A25_ScbShareAccessWriters Int32 | |
A26_ScbShareAccessDeleters Int32 | |
A27_ScbShareAccessSharedRead Int32 | |
A28_ARGUMENT_PRESENTLcbLcbLinkShareAccessDeleters0 Int32 |
Event ID 180
#Fields #
| Name | Description |
|---|---|
A10_FILEID_FROM_SOURCEFileNLine UInt32 | |
A11_LINENUM_FROM_SOURCEFileNLine Int32 | |
A12_Status HexInt32 | |
A13__ProcessName CountedMbcsString |
Event ID 181
#Fields #
| Name | Description |
|---|---|
A10_FILEID_FROM_SOURCEFileNLine UInt32 | |
A11_LINENUM_FROM_SOURCEFileNLine Int32 | |
A12_Status HexInt32 | |
A13__ProcessName CountedMbcsString |
Event ID 182
#Fields #
| Name | Description |
|---|---|
A10_FILEID_FROM_SOURCEFileNLine UInt32 | |
A11_LINENUM_FROM_SOURCEFileNLine Int32 | |
A12_Status HexInt32 | |
A13__ProcessName CountedMbcsString |
Event ID 183
#Fields #
| Name | Description |
|---|---|
A10_FILEID_FROM_SOURCEFileNLine UInt32 | |
A11_LINENUM_FROM_SOURCEFileNLine Int32 | |
A12_Status HexInt32 | |
A13__ProcessName CountedMbcsString |
Event ID 184
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_StartingCluster HexInt64 | |
A12_RunLength HexInt32 |
Event ID 186
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_MarkUnusedContext Pointer | |
A12_MarkUnusedContextDeallocatedClusters Pointer | |
A13__MarkUnusedContextDeallocatedClustersMcb Pointer |
Event ID 187
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_StartingCluster HexInt64 | |
A12_RunLength HexInt32 | |
A13__MarkUnusedContextDeallocatedClustersMcb Pointer |
Event ID 188
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11__MarkUnusedContextDeallocatedClustersMcb Pointer |
Event ID 189
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_MarkUnusedContext Pointer | |
A12_IrpContext Pointer |
Event ID 191
#Fields #
| Name | Description |
|---|---|
A10_Src Pointer | |
A11_Dst Pointer | |
A12_SrcClustersCount HexInt64 | |
A13_SrcDeallocatedClustersClusterCount HexInt64 | |
A14_SrcDsmAttrDataSetRangesLength HexInt32 |
Event ID 192
#Fields #
| Name | Description |
|---|---|
A10_Src Pointer | |
A11_Dst Pointer | |
A12_SrcClustersCount HexInt64 | |
A13_DstClustersCount HexInt64 | |
A14_DstDsmAttrDataSetRangesLength HexInt32 | |
A15_DstFirstDataSetRangePtrLengthInBytes HexInt64 | |
A16_DstFirstDataSetRangePtrStartingOffset HexInt64 |
Event ID 193
#Event ID 194
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_MarkUnusedContext Pointer | |
A12_VcbDeallocatedClusters HexInt64 | |
A13_VcbDeallocatedClustersListLengthInTrim HexInt32 | |
A14_VcbDeallocatedClustersListLengthToDrain HexInt32 | |
A15_ClustersClusterCount HexInt64 | |
A16_InitialRanges HexInt32 |
Event ID 195
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_MarkUnusedContext Pointer | |
A12_StartingLcn HexInt64 | |
A13_ClusterCount HexInt64 | |
A14_FreeClusterBase1 HexInt64 | |
A15_FreeClusterCount1 HexInt64 | |
A16_FreeClusterBase2 HexInt64 | |
A17_FreeClusterCount2 HexInt64 |
Event ID 198
#Event ID 204
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_SmallMarkUnusedContext Pointer | |
A12_MarkUnusedContext Pointer |
Event ID 207
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_MarkUnusedContext Pointer | |
A12_TrimEntryCount HexInt32 | |
A13_DataSetRangePtrStartingOffset HexInt64 | |
A14_DataSetRangePtrLengthInBytes HexInt64 |
Event ID 212
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_Status HexInt32 | |
A12_MarkUnusedContext Pointer | |
A13_MarkUnusedContextNULL__MarkUnusedContextDeallocatedClustersNULLMarkUnusedContextDeallocatedClustersClusterCount1LL HexInt64 |
Event ID 213
#Event ID 222
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_DeallocatedClustersToWaitForDeallocatedClusters Pointer |
Event ID 224
#Fields #
| Name | Description |
|---|---|
A10_IrpContextVcb Pointer | |
A11_DeallocatedClustersToWaitForDeallocatedClusters Pointer |
Event ID 225
#Fields #
| Name | Description |
|---|---|
A10_WaitInSeconds Int32 | |
A11_CurrentTimeQuadPartDeallocatedClustersToWaitForEndTimeQuadPartULONGCurrentTimeQuadPartDeallocatedClustersToWaitForEndTimeQuadPartNtfsDataSystemTimeIncrementINTERVAL_ONE_SECOND0 Int32 | |
A12_IrpContext Pointer | |
A13_IrpContextVcb Pointer | |
A14_DeallocatedClusters Pointer |
Event ID 226
#Fields #
| Name | Description |
|---|---|
A10_WaitInSeconds Int32 | |
A11_CurrentTimeQuadPartDeallocatedClustersToWaitForEndTimeQuadPartULONGCurrentTimeQuadPartDeallocatedClustersToWaitForEndTimeQuadPartNtfsDataSystemTimeIncrementINTERVAL_ONE_SECOND0 Int32 | |
A12_IrpContext Pointer | |
A13_IrpContextVcb Pointer | |
A14_DeallocatedClusters Pointer |
Event ID 232
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_MarkUnusedContext Pointer | |
A12_RunIndex UInt32 | |
A13_StartingOffset HexInt64 | |
A14_LengthInBytes HexInt64 |
Event ID 233
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_MarkUnusedContext Pointer | |
A12_DataSetRangeCount UInt32 | |
A13_McbRunCount UInt32 | |
A14_SmartTrimFreeRangeCount UInt32 |
Event ID 234
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_MarkUnusedContext Pointer | |
A12_RunIndex UInt32 | |
A13_DataSetRangeStartingOffset HexInt64 | |
A14_DataSetRangeLengthInBytes HexInt64 |
Event ID 235
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_StartingLcn HexInt64 | |
A12_ClusterCount HexInt64 | |
A13_FirstTpMapBit HexInt32 | |
A14_LastTpMapBit HexInt32 |
Event ID 237
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_SlabRangeIndex UInt32 | |
A12_SlabRangeFirstTPMapBit HexInt32 | |
A13_SlabRangeLastTPMapBit HexInt32 |
Event ID 244
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_TpMapBit HexInt32 | |
A12_SlabBaseLcn HexInt64 | |
A13_SlabLengthInClusters HexInt64 |
Event ID 248
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbVcbState HexInt32 | |
A15_IrpSpFlags HexInt32 |
Event ID 249
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Status HexInt32 |
Event ID 250
#Event ID 251
#Event ID 252
#Event ID 253
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_StartingVbo HexInt64 | |
A12_ByteCount HexInt32 |
Event ID 255
#Fields #
| Name | Description |
|---|---|
A10_ULONGBadVcn HexInt32 | |
A11_PLARGE_INTEGER_BadVcnHighPart HexInt32 |
Event ID 256
#Fields #
| Name | Description |
|---|---|
A10_ULONGBadLcn HexInt32 | |
A11_PLARGE_INTEGER_BadLcnHighPart HexInt32 |
Event ID 257
#Event ID 258
#Event ID 260
#Fields #
| Name | Description |
|---|---|
A10_NewBufferSize HexInt32 | |
A11_NtfsGetCompressionBufferSize HexInt32 |
Event ID 265
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_ScbPersist HexInt32 | |
A20_CcbFlags HexInt32 |
Event ID 268
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_ScbPersist HexInt32 | |
A20_CcbFlags HexInt32 |
Event ID 269
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A14_MoveDataStartingVcnQuadPart HexInt64 | |
A15_TransferClusters HexInt64 | |
A16_Lcn HexInt64 | |
A17_MoveDataStartingLcnQuadPart HexInt64 | |
A18_CopyLength HexInt32 | |
A19_FlagsUseDelayedAllocation Int32 | |
A20_Status HexInt32 |
Event ID 270
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A14_MoveDataStartingVcnQuadPart HexInt64 | |
A15_TransferClusters HexInt64 | |
A16_Lcn HexInt64 | |
A17_MoveDataStartingLcnQuadPart HexInt64 | |
A18_CopyLength HexInt32 | |
A19_FlagsUseDelayedAllocation Int32 | |
A20_MyStatus HexInt32 |
Event ID 271
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A14_Lcn HexInt64 | |
A15_CopyLength HexInt32 | |
A16_MyStatus HexInt32 |
Event ID 272
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A14_MoveDataStartingLcnQuadPart HexInt64 | |
A15_CopyLength HexInt32 | |
A16_MyStatus HexInt32 |
Event ID 273
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A14_MoveDataStartingVcnQuadPart HexInt64 | |
A15_TransferClusters HexInt64 | |
A16_Lcn HexInt64 | |
A17_MoveDataStartingLcnQuadPart HexInt64 | |
A18_FlagsUseDelayedAllocation Int32 | |
A19_ValidClusters HexInt64 |
Event ID 274
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A14_MoveDataStartingVcnQuadPart HexInt64 | |
A15_TransferClusters HexInt64 |
Event ID 275
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_FcbNULLNtfsFullFileRefNumber_FcbFileReference0 HexInt64 | |
A16_CcbNULLCcbFlags0 HexInt32 |
Event ID 276
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18_ScbAttributeNameBuffer UnicodeString | |
A19_ScbPersist HexInt32 | |
A20_CcbFlags HexInt32 |
Event ID 279
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_ScbPersist HexInt32 | |
A20_CcbNULLCcbFlags0 HexInt32 |
Event ID 280
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_ScbHeaderValidDataLengthQuadPart HexInt64 | |
A12_ScbHeaderFileSizeQuadPart HexInt64 | |
A13_QueryDaxExtentsFileOffset HexInt64 | |
A14_StartingVcn HexInt64 | |
A15_QueryDaxExtentsLength HexInt64 |
Event ID 281
#Fields #
| Name | Description |
|---|---|
A10_QueryDaxExtentsFileOffset HexInt64 | |
A11_QueryDaxExtentsLength HexInt64 | |
A12_EffectiveInputFileRegionLength HexInt64 | |
A13_StartingVcn HexInt64 | |
A14_BeyondEndVcn HexInt64 | |
A15_RemainingClusterCount HexInt64 | |
A16_LastVcnInFile HexInt64 |
Event ID 282
#Event ID 283
#Fields #
| Name | Description |
|---|---|
A10_RemainingClusterCount HexInt64 | |
A11_DataSetRangeIndex Int32 | |
A12_OutputBufferLength Int32 |
Event ID 284
#Fields #
| Name | Description |
|---|---|
A10_ExtentsDescriptorNumberOfValidRuns HexInt32 | |
A11_MaxRuns HexInt32 | |
A12_BytesReturned HexInt64 |
Event ID 285
#Fields #
| Name | Description |
|---|---|
A10_RemainingClusterCount HexInt64 | |
A11_ExtentsDescriptorNumberOfValidRuns HexInt32 |
Event ID 286
#Fields #
| Name | Description |
|---|---|
A10_RemainingClusterCount HexInt64 | |
A11_ExtentsDescriptorNumberOfValidRuns HexInt32 |
Event ID 287
#Fields #
| Name | Description |
|---|---|
A10_ExtentsDescriptorNumberOfValidRuns HexInt32 | |
A11_MaxRuns HexInt32 | |
A12_Status HexInt32 | |
A13_BytesReturned HexInt64 |
Event ID 288
#Fields #
| Name | Description |
|---|---|
A10_ExtentsDescriptorRunIndexBasePage HexInt64 | |
A11_ExtentsDescriptorRunIndexPageCount HexInt64 |
Event ID 291
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_CcbFlags HexInt32 |
Event ID 292
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_ARGUMENT_PRESENTCcbCcbAccessFlags0 HexInt32 | |
A20_ARGUMENT_PRESENTCreateContextCreateContextPreviouslyGrantedAccess0 HexInt32 |
Event ID 293
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_CcbFlags HexInt32 |
Event ID 294
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_CcbNULLCcbFlags0 HexInt32 |
Event ID 295
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_ScbVcbVpbRealDeviceFlags HexInt32 |
Event ID 296
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_RenameCleanupTargetLinkFcb Pointer | |
A15_NtfsFullFileRefNumber_RenameCleanupTargetLinkFcbFileReference HexInt64 | |
A16_RenameCleanupTargetLinkFcbFcbState HexInt32 |
Event ID 297
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_RenameCleanupTargetLinkFcb Pointer | |
A15_NtfsFullFileRefNumber_RenameCleanupTargetLinkFcbFileReference HexInt64 | |
A16_RenameCleanupTargetLinkFcbTxfFcbTxfNumWriters Int32 |
Event ID 298
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_LcbToDeleteFcb Pointer | |
A15_NtfsFullFileRefNumber_LcbToDeleteFcbFileReference HexInt64 | |
A16_LcbToDelete Pointer | |
A17_WppCountedStringWLcbToDeleteFileNameAttrFileNameUSHORTLcbToDeleteFileNameAttrFileNameLength CountedUtf16String | |
A18_LcbToDeleteTxfNumWriters Int32 |
Event ID 299
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_RenameCleanupTargetLinkFcb Pointer | |
A15_NtfsFullFileRefNumber_RenameCleanupTargetLinkFcbFileReference HexInt64 | |
A16_RenameCleanupTargetLinkFcbCleanupCount Int32 |
Event ID 300
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_LcbToDeleteFcb Pointer | |
A15_NtfsFullFileRefNumber_LcbToDeleteFcbFileReference HexInt64 | |
A16_LcbToDelete Pointer | |
A17_WppCountedStringWLcbToDeleteFileNameAttrFileNameUSHORTLcbToDeleteFileNameAttrFileNameLength CountedUtf16String | |
A18_LcbToDeleteCleanupCount Int32 | |
A19_SplitPrimaryLcb Pointer | |
A20_SplitPrimaryLcbNULLWppCountedStringWSplitPrimaryLcbFileNameAttrFileNameUSHORTSplitPrimaryLcbFileNameAttrFileNameLengthWppCountedStringWNULL0 CountedUtf16String | |
A21_SplitPrimaryLcbNULLSplitPrimaryLcbCleanupCount0 Int32 |
Event ID 301
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_LcbFcb Pointer | |
A15_NtfsFullFileRefNumber_LcbFcbFileReference HexInt64 | |
A16_LcbFcbFcbState HexInt32 | |
A17_Lcb Pointer | |
A18_WppCountedStringWLcbFileNameAttrFileNameUSHORTLcbFileNameAttrFileNameLength CountedUtf16String | |
A19_LcbFileNameAttrFlags HexInt32 | |
A20_LcbLcbState HexInt32 |
Event ID 302
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_ScbFcbInfoFileAttributes HexInt32 |
Event ID 303
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_TargetParentScbFcb Pointer | |
A15_NtfsFullFileRefNumber_TargetParentScbFcbFileReference HexInt64 | |
A16_TargetParentScbFcbFcbState HexInt32 |
Event ID 304
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_TargetParentScbFcb Pointer | |
A15_NtfsFullFileRefNumber_TargetParentScbFcbFileReference HexInt64 | |
A16_TargetParentScbFcbInfoFileAttributes HexInt32 | |
A17_TargetParentScbFcbFcbState HexInt32 |
Event ID 305
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 |
Event ID 306
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_NtfsFullFileRefNumber_TargetParentScbFcbFileReference HexInt64 |
Event ID 307
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String |
Event ID 308
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_TxfVisibleLinks Int32 |
Event ID 309
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_AccessStatus HexInt32 |
Event ID 310
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_TargetParentScbFcb Pointer | |
A15_NtfsFullFileRefNumber_TargetParentScbFcbFileReference HexInt64 | |
A16__NewLinkName CountedUtf16String |
Event ID 311
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_TargetParentScbFcb Pointer | |
A15_NtfsFullFileRefNumber_TargetParentScbFcbFileReference HexInt64 | |
A16__NewLinkName CountedUtf16String | |
A17_TargetParentScbFcbTxfRmcbRmState HexInt32 |
Event ID 312
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_LcbFcb Pointer | |
A15_NtfsFullFileRefNumber_LcbFcbFileReference HexInt64 | |
A16_Lcb Pointer | |
A17_WppCountedStringWLcbFileNameAttrFileNameUSHORTLcbFileNameAttrFileNameLength CountedUtf16String |
Event ID 313
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_LcbFcb Pointer | |
A15_NtfsFullFileRefNumber_LcbFcbFileReference HexInt64 | |
A16_Lcb Pointer | |
A17_WppCountedStringWLcbFileNameAttrFileNameUSHORTLcbFileNameAttrFileNameLength CountedUtf16String | |
A18_NtfsFullFileRefNumber_ParentScbFcbFileReference HexInt64 |
Event ID 314
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_NextScbVcb Pointer | |
A12__NextScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWNextScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHNextScbVcbVpb CountedUtf16String | |
A14_NextScbFcb Pointer | |
A15_NtfsFullFileRefNumber_NextScbFcbFileReference HexInt64 | |
A16_NextScbCleanupCount Int32 |
Event ID 315
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_NextScbVcb Pointer | |
A12__NextScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWNextScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHNextScbVcbVpb CountedUtf16String | |
A14_NextScbFcb Pointer | |
A15_NtfsFullFileRefNumber_NextScbFcbFileReference HexInt64 | |
A16_ByIdCcbs Int32 | |
A17_NextScbCleanupCount Int32 |
Event ID 316
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_ScbState HexInt32 | |
A20_ScbScbTypeDataHighWaterMark Int64 |
Event ID 317
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_DirectoryScbVcb Pointer | |
A12__DirectoryScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWDirectoryScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHDirectoryScbVcbVpb CountedUtf16String | |
A14_DirectoryScbFcb Pointer | |
A15_NtfsFullFileRefNumber_DirectoryScbFcbFileReference HexInt64 | |
A16_ULONGIrpIoStatusInformation Int32 | |
A17_BatchOplockCount Int32 |
Event ID 318
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12_Fcb Pointer | |
A13_LocalFlagsEntireFlags HexInt32 |
Event ID 320
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12_LocalFlagsEntireFlags HexInt32 |
Event ID 323
#Fields #
| Name | Description |
|---|---|
A10_PNTFS_DISK_FLUSH_CONTEXTContextVcb Pointer | |
A11_Context Pointer |
Event ID 324
#Fields #
| Name | Description |
|---|---|
A10_PNTFS_DISK_FLUSH_CONTEXTContextVcb Pointer | |
A11_Context Pointer | |
A12_NtfsDataDiskFlushContextCompletedWorkItemListFlink Pointer |
Event ID 325
#Event ID 326
#Event ID 327
#Fields #
| Name | Description |
|---|---|
A10_Irp Pointer | |
A11_IrpContext Pointer | |
A12_IrpContextVcb Pointer | |
A13_IrpSpMinorFunction HexInt32 | |
A14_FsControlCode HexInt32 |
Event ID 328
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbVcbState HexInt32 | |
A15_VcbDisallowDismountCount Int32 | |
A16_ExplicitLock10 Int32 | |
A17_ReadULongNoFence_VcbCleanupCount Int32 | |
A18_UserHandleCountSystemHandleCountVcbExternalMetadataCleanupCount Int32 |
Event ID 329
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbVcbState HexInt32 |
Event ID 330
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Status HexInt32 |
Event ID 331
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Status HexInt32 |
Event ID 332
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbCloseCount Int32 | |
A15_VcbSystemFileCloseCount Int32 | |
A16_UserHandleCount Int32 |
Event ID 333
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 334
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ActiveRmCount Int32 | |
A15_DefaultRmActive10 Int32 |
Event ID 335
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDVcbTxfVcbDefaultRm Pointer | |
A12_VcbTxfVcbDefaultRmNULL_VcbTxfVcbDefaultRmRmIdNULL GUID |
Event ID 336
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 337
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12__VolumeLabel CountedUtf16String | |
A13__VcbDeviceName CountedUtf16String |
Event ID 338
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 339
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbVcbState HexInt32 |
Event ID 340
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbVcbState HexInt32 | |
A15_VcbReadOnlyCloseCount Int32 | |
A16_VcbCloseCount Int32 | |
A17_VcbSystemFileCloseCount Int32 |
Event ID 341
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbVcbState HexInt32 |
Event ID 342
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 343
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 344
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbAccessFlags HexInt32 |
Event ID 345
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbAccessFlags HexInt32 |
Event ID 346
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbAccessFlags HexInt32 |
Event ID 347
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 | |
A15_TypeOfOpen Int32 |
Event ID 348
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 | |
A15_IrpRequestorMode Int32 |
Event ID 349
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 350
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 351
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbAccessFlags HexInt32 | |
A15_CcbFlags HexInt32 |
Event ID 352
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbAccessFlags HexInt32 | |
A15_CcbFlags HexInt32 | |
A16_CallerId Int32 | |
A17_ContextOwnerId Int32 |
Event ID 353
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 | |
A18_FileObjectWriteAccess10 Int32 |
Event ID 354
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 | |
A18_ScbAttributeFlags HexInt32 |
Event ID 355
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ZeroFlags HexInt32 | |
A12_IrpRequestorMode Int32 |
Event ID 356
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Scb Pointer | |
A12_IrpSpFileObject Pointer |
Event ID 358
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 |
Event ID 359
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 |
Event ID 360
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 361
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 362
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 365
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 | |
A18_HandleInfoHandleInfo HexInt32 | |
A19_IrpRequestorMode Int32 |
Event ID 366
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_DasdCcbNULLDasdCcbAccessFlags0 HexInt32 |
Event ID 367
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_ScbPersist HexInt32 | |
A20_HandleInfoHandleInfo HexInt32 |
Event ID 368
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_FcbFcbState2 HexInt32 | |
A17_Scb Pointer | |
A18_ScbAttributeTypeCode HexInt32 | |
A19__ScbAttributeName CountedUtf16String | |
A20_ScbPersist HexInt32 | |
A21_HandleInfoHandleInfo HexInt32 |
Event ID 369
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_FcbFcbState HexInt32 | |
A17_Scb Pointer | |
A18_ScbAttributeTypeCode HexInt32 | |
A19__ScbAttributeName CountedUtf16String | |
A20_ScbPersist HexInt32 | |
A21_HandleInfoHandleInfo HexInt32 | |
A22_IrpRequestorMode Int32 |
Event ID 370
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_ScbFcbFcbState HexInt32 | |
A17_HandleInfoHandleInfo HexInt32 |
Event ID 371
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_HandleInfoHandleInfo HexInt32 |
Event ID 372
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_ScbShareAccessWriters Int32 |
Event ID 373
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 374
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_TypeOfOpen Int32 | |
A15_IrpSpFileObjectWriteAccess10 Int32 | |
A16_ScbFcb Pointer | |
A17_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A18_ScbAttributeTypeCode HexInt32 | |
A19_ScbFcbFcbState HexInt32 | |
A20_CcbNULL_CcbFullFileNameNULL CountedUtf16String |
Event ID 375
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 377
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 378
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 379
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_IrpContextVcb Pointer | |
A12__IrpContextVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWIrpContextVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHIrpContextVcbVpb CountedUtf16String | |
A14_NtfsDataFlags HexInt32 |
Event ID 380
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 382
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 383
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 384
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_IrpContextVcb Pointer | |
A12__IrpContextVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWIrpContextVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHIrpContextVcbVpb CountedUtf16String |
Event ID 385
#Fields #
| Name | Description |
|---|---|
A10_ScrubResumeContextSystemScbIndex UInt32 | |
A11_ScrubResumeContextResumeVcn HexInt64 | |
A12_ScrubResumeContextResumeVcnOffset HexInt32 |
Event ID 386
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_ScrubResumeContextResumeVcn HexInt64 | |
A12_ScrubResumeContextResumeVcnOffset HexInt32 |
Event ID 388
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_TypeOfOpen Int32 | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17__CcbFullFileName CountedUtf16String | |
A18_CcbAccessFlags HexInt32 |
Event ID 390
#Event ID 391
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_ScrubContextOperationStatus HexInt32 | |
A12_ScrubContextNumberOfBytesRepaired HexInt64 | |
A13_ScrubContextNumberOfBytesFailed HexInt64 | |
A14_ScrubContextErrorFileOffset HexInt64 | |
A15_ScrubContextErrorLength HexInt64 | |
A16_ScrubContextParityExtentDataNumberOfParityExtents UInt32 |
Event ID 392
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_Status HexInt32 | |
A12_ScrubContextNumberOfBytesRepaired HexInt64 | |
A13_ScrubContextNumberOfBytesFailed HexInt64 | |
A14_ScrubContextParityExtentDataNumberOfParityExtents UInt32 |
Event ID 395
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_ScrubIoCount UInt32 | |
A12_IrpCancel UInt32 | |
A13_ScrubContextParityExtentDataNumberOfParityExtents UInt32 |
Event ID 399
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_FileScrubOffset HexInt64 | |
A12_SectorAlignedVdl HexInt64 |
Event ID 401
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_StartingVcn HexInt64 | |
A12_ClusterCount HexInt64 |
Event ID 403
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_DsmRangeStartingOffset HexInt64 | |
A12_DsmRangeStartingOffsetDsmRangeLengthInBytes HexInt64 | |
A13_DsmRangeLengthInBytes HexInt64 | |
A14_StartingVcn HexInt64 | |
A15_StartingVcnOffset HexInt32 | |
A16_SectorAlignedVdl HexInt64 |
Event ID 404
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_StartingVcn HexInt64 | |
A12_ScrubContextErrorFileOffset HexInt64 | |
A13_ScrubbedLength HexInt64 | |
A14_ScrubContextOperationStatus HexInt32 | |
A15_ScrubContextNumberOfBytesFailed HexInt64 | |
A16_ScrubContextNumberOfBytesRepaired HexInt64 | |
A17_NewParityExtentCount UInt32 |
Event ID 410
#Event ID 411
#Event ID 414
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_StartingVcn HexInt64 | |
A12_ClusterCount HexInt64 |
Event ID 415
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_RepairDataSetRangeStartingOffset HexInt64 | |
A12_RepairDataSetRangeStartingOffsetRepairDataSetRangeLengthInBytes HexInt64 | |
A13_RepairDataSetRangeLengthInBytes HexInt64 | |
A14_RepairFileOffset HexInt64 |
Event ID 419
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_TypeOfOpen Int32 | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17__CcbFullFileName CountedUtf16String | |
A18_CcbAccessFlags HexInt32 |
Event ID 420
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_TypeOfOpen Int32 | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 421
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_TypeOfOpen Int32 | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 422
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_TypeOfOpen Int32 | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 423
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String |
Event ID 424
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_TypeOfOpen Int32 | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_IrpRequestorMode Int32 |
Event ID 425
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_VcbVcbState HexInt32 |
Event ID 426
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_ScbPersist HexInt32 | |
A20_CcbNULLCcbFlags0 HexInt32 |
Event ID 427
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_FcbInfoFileAttributes HexInt32 | |
A17_IrpSpFlags HexInt32 |
Event ID 428
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A17_IrpRequestorMode Int32 |
Event ID 429
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A17_VcbVcbState HexInt32 |
Event ID 430
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_ScbPersist HexInt32 | |
A20_CcbNULLCcbFlags0 HexInt32 |
Event ID 431
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_FcbInfoFileAttributes HexInt32 | |
A17_IrpSpFlags HexInt32 |
Event ID 432
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A15_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A16_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 433
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_ScbAttributeTypeCode HexInt32 | |
A18_ScbFcbFcbState2 HexInt32 | |
A19_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A20_CcbNULLCcbAccessFlags0 HexInt32 | |
A21_CcbNULLCcbFlags20 HexInt32 |
Event ID 434
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_ScbAttributeTypeCode HexInt32 | |
A18_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A19_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 435
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A17_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 436
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_PsGetCurrentThread Pointer | |
A12_Status HexInt32 | |
A13__DeletedFiles CountedUtf16String |
Event ID 437
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_PsGetCurrentThread Pointer | |
A12_Status HexInt32 |
Event ID 438
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_PsGetCurrentThread Pointer | |
A12_Status HexInt32 | |
A13__FileNameToDelete CountedUtf16String |
Event ID 439
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_PsGetCurrentThread Pointer | |
A12_Status HexInt32 |
Event ID 440
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_PsGetCurrentThread Pointer | |
A12_Status HexInt32 |
Event ID 441
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_CcbNULLCcbAccessFlags0 HexInt32 | |
A19_EffectiveMode Int32 |
Event ID 442
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_StartOffset HexInt64 | |
A12_Length HexInt64 | |
A13_StartVcn HexInt64 | |
A14_BeyondEndVcn HexInt64 |
Event ID 444
#Fields #
| Name | Description |
|---|---|
A10_FsInputRangeIndex UInt32 | |
A11_FsInputRangesFsInputRangeIndexFileOffset HexInt64 | |
A12_FsInputRangesFsInputRangeIndexVolumeOffset HexInt64 | |
A13_FsInputRangesFsInputRangeIndexLengthInBytes HexInt64 |
Event ID 445
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_Status HexInt32 | |
A12_BOOLEANAbnormalTermination UInt8 |
Event ID 447
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_IrpContextVcb Pointer | |
A12__IrpContextVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWIrpContextVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHIrpContextVcbVpb CountedUtf16String |
Event ID 448
#Event ID 449
#Fields #
| Name | Description |
|---|---|
A10_Table Pointer | |
A11_ParentScb Pointer | |
A12__ParentScbScbTypeIndexNormalizedName CountedUtf16String | |
A13_RemainingName CountedUtf16String |
Event ID 450
#Event ID 451
#Fields #
| Name | Description |
|---|---|
A10_FoundLcb Pointer | |
A11__FoundLcbExactCaseLinkLinkName CountedUtf16String |
Event ID 452
#Event ID 453
#Fields #
| Name | Description |
|---|---|
A10_Table Pointer | |
A11_NewHashEntryHashValue HexInt32 | |
A12_NewHashEntryFullNameLength Int32 | |
A13_NewHashEntryHashLcb Pointer | |
A14__NewHashEntryHashLcbExactCaseLinkLinkName CountedUtf16String |
Event ID 454
#Fields #
| Name | Description |
|---|---|
A10_Table Pointer | |
A11_HashValue HexInt32 | |
A12_HashLcb Pointer | |
A13__HashLcbExactCaseLinkLinkName CountedUtf16String |
Event ID 456
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_PercentFull Int32 | |
A12_VcbWaitForCcLoggedDataActivityCount Int32 |
Event ID 464
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_NtfsFullSegmentNumber_ScbFcbFileReference HexInt64 |
Event ID 466
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbVcbState HexInt32 |
Event ID 471
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_IrpContextOriginatingIrp Pointer | |
A12_PsGetCurrentThread Pointer | |
A13_IrpContextExceptionStatus HexInt32 |
Event ID 472
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_IrpContextOriginatingIrp Pointer | |
A12_PsGetCurrentThread Pointer | |
A13_IrpContextExceptionStatus HexInt32 |
Event ID 473
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_IrpContextOriginatingIrp Pointer | |
A12_PsGetCurrentThread Pointer | |
A13_IrpContextExceptionStatus HexInt32 | |
A14_FailedFlushCount Int32 |
Event ID 474
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_IrpContextOriginatingIrp Pointer | |
A12_PsGetCurrentThread Pointer | |
A13_IrpContextExceptionStatus HexInt32 |
Event ID 475
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_IrpContextOriginatingIrp Pointer | |
A12_PsGetCurrentThread Pointer | |
A13_IrpContextExceptionStatus HexInt32 |
Event ID 478
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_ActiveLsnQuadPart HexInt64 | |
A12_ClearAll UInt32 |
Event ID 484
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_Clusters Pointer | |
A12_ClustersClusterCount HexInt64 | |
A13_ClustersLsnQuadPart HexInt64 | |
A14_ClustersFlags HexInt32 |
Event ID 485
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_Clusters Pointer | |
A12_i Int32 | |
A13_StartingLcn HexInt64 | |
A14_ClusterCount HexInt64 |
Event ID 486
#Event ID 491
#Event ID 492
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_StartingLcn HexInt64 | |
A12_ULONGClusterCount HexInt32 |
Event ID 493
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_StartingLcnStartingIndex HexInt64 | |
A12_runLength HexInt32 |
Event ID 497
#Fields #
| Name | Description |
|---|---|
A10_McbScb Pointer | |
A11_Mcb Pointer | |
A12_StartingVcn HexInt64 | |
A13_Count HexInt64 |
Event ID 499
#Fields #
| Name | Description |
|---|---|
A10_McbScb Pointer | |
A11_Mcb Pointer | |
A12_Vcn HexInt64 | |
A13_Lcn HexInt64 | |
A14_RunCount HexInt64 |
Event ID 501
#Fields #
| Name | Description |
|---|---|
A10_McbScb Pointer | |
A11_Mcb Pointer | |
A12_StartingVcn HexInt64 | |
A13_EndingVcn HexInt64 | |
A14_TruncateOnly UInt32 |
Event ID 505
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_IrpContextExceptionStatus HexInt32 |
Event ID 506
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12__VolumeLabel CountedUtf16String | |
A13__VcbDeviceName CountedUtf16String |
Event ID 510
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_AttrListAllocationSize HexInt64 |
Event ID 511
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_AttrListAllocationSize HexInt64 |
Event ID 515
#Fields #
| Name | Description |
|---|---|
A10_IrpContextLogFullReason UInt32 | |
A11_BackTrace0 Pointer | |
A12_BackTrace1 Pointer | |
A13_BackTrace2 Pointer | |
A14_BackTrace3 Pointer | |
A15_BackTrace4 Pointer | |
A16_BackTrace5 Pointer | |
A17_BackTrace6 Pointer | |
A18_BackTrace7 Pointer | |
A19_BackTrace8 Pointer | |
A20_BackTrace9 Pointer | |
A21_BackTrace10 Pointer | |
A22_BackTrace11 Pointer | |
A23_BackTrace12 Pointer | |
A24_BackTrace13 Pointer | |
A25_BackTrace14 Pointer | |
A26_BackTrace15 Pointer | |
A27_BackTrace16 Pointer | |
A28_BackTrace17 Pointer | |
A29_BackTrace18 Pointer | |
A30_BackTrace19 Pointer |
Event ID 519
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Irp Pointer | |
A12_IrpContextVcb Pointer | |
A13_NtfsFailedAborts HexInt32 | |
A14_GetExceptionCode HexInt32 |
Event ID 520
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Irp Pointer | |
A12_IrpContextVcb Pointer | |
A13_NextScb Pointer | |
A14_PULONGLONG_NextScbFcbFileReference HexInt64 |
Event ID 521
#Fields #
| Name | Description |
|---|---|
A10_IrpSpParametersWriteByteOffsetHighPart HexInt32 | |
A11_IrpSpParametersWriteByteOffsetLowPart HexInt32 |
Event ID 522
#Fields #
| Name | Description |
|---|---|
A10_ExceptionCode HexInt32 | |
A11_IrpSpParametersWriteByteOffsetHighPart HexInt32 | |
A12_IrpSpParametersWriteByteOffsetLowPart HexInt32 |
Event ID 523
#Fields #
| Name | Description |
|---|---|
A10_IrpSpMajorFunction UInt32 | |
A11_IrpSpMinorFunction HexInt32 | |
A12_Irp Pointer | |
A13_IrpContext Pointer | |
A14_Status HexInt32 |
Event ID 524
#Fields #
| Name | Description |
|---|---|
A10_IrpSpMajorFunction UInt32 | |
A11_IrpSpMinorFunction HexInt32 | |
A12_Irp Pointer | |
A13_IrpContext Pointer | |
A14_Status HexInt32 |
Event ID 525
#Event ID 526
#Event ID 529
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 | |
A18_IrpSpMinorFunction HexInt32 |
Event ID 530
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 | |
A18_IrpSpMinorFunction HexInt32 |
Event ID 531
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 | |
A18_IrpSpMinorFunction HexInt32 |
Event ID 532
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDVcbTxfVcbDefaultRm Pointer | |
A12__VcbTxfVcbDefaultRmRmId GUID |
Event ID 533
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_IrpContextVcb Pointer | |
A12__IrpContextVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWIrpContextVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHIrpContextVcbVpb CountedUtf16String |
Event ID 534
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17__CcbFullFileName CountedUtf16String | |
A18_CcbAccessFlags HexInt32 | |
A19_CcbFlags HexInt32 |
Event ID 536
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 | |
A18_IrpSpFileObjectWriteAccess Int32 |
Event ID 537
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 | |
A18_IrpSpFileObjectWriteAccess Int32 |
Event ID 538
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 | |
A18_IrpSpFileObjectWriteAccess Int32 |
Event ID 539
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_VcbLogFileObject Pointer | |
A12_IrpContext Pointer |
Event ID 541
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_VcbLogFileObject Pointer | |
A12_IrpContext Pointer |
Event ID 544
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_FileRecordSegmentNumberHighPart HexInt32 | |
A12_FileRecordSegmentNumberLowPart HexInt32 | |
A13_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 |
Event ID 545
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_FileRecordSegmentNumberHighPart HexInt32 | |
A12_FileRecordSegmentNumberLowPart HexInt32 | |
A13_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 |
Event ID 546
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_FileRecordSegmentNumberHighPart HexInt32 | |
A12_FileRecordSegmentNumberLowPart HexInt32 | |
A13_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 | |
A14_AttributeTypeCode HexInt32 | |
A15_LogRecordRecordOffset HexInt32 | |
A16_Length HexInt32 |
Event ID 547
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_FileRecordSegmentNumberHighPart HexInt32 | |
A12_FileRecordSegmentNumberLowPart HexInt32 | |
A13_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 | |
A14_PATTRIBUTE_RECORD_HEADERDataTypeCode HexInt32 |
Event ID 548
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_FileRecordSegmentNumberHighPart HexInt32 | |
A12_FileRecordSegmentNumberLowPart HexInt32 | |
A13_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 | |
A14_NtfsFullSegmentNumber_FileReference HexInt64 |
Event ID 549
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_FileRecordSegmentNumberHighPart HexInt32 | |
A12_FileRecordSegmentNumberLowPart HexInt32 | |
A13_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 | |
A14_AttributeFormNonresidentAllocatedLength HexInt64 | |
A15_AttributeFormNonresidentFileSize HexInt64 | |
A16_AttributeFormNonresidentValidDataLength HexInt64 | |
A17_AttributeFormNonresidentTotalAllocated HexInt64 | |
A18_SizesAllocationSize HexInt64 | |
A19_SizesFileSize HexInt64 | |
A20_SizesValidDataLength HexInt64 | |
A21_SizesTotalAllocated HexInt64 |
Event ID 552
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 |
Event ID 553
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 |
Event ID 554
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String |
Event ID 555
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisFcbTxfFcbTxfNumWriters Int32 |
Event ID 556
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_Status HexInt32 |
Event ID 557
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisFcbInfoFileAttributes HexInt32 |
Event ID 558
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisFcbInfoFileAttributes HexInt32 |
Event ID 559
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 |
Event ID 560
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisFcbInfoFileAttributes HexInt32 | |
A17_IrpSpFlags HexInt32 |
Event ID 561
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_CcbAccessFlags HexInt32 | |
A17_AccessStatus HexInt32 |
Event ID 562
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_NextScb Pointer | |
A17_NextScbAttributeTypeCode HexInt32 | |
A18__NextScbAttributeName CountedUtf16String |
Event ID 563
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A17_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 564
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbVcbState HexInt32 |
Event ID 565
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A17_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 566
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A17_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 567
#Event ID 568
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_Fcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 569
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_Fcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 570
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_Fcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 571
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_FcbFcbState HexInt32 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String |
Event ID 572
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A17_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 573
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A17_CcbNULLCcbAccessFlags0 HexInt32 | |
A18_Flags HexInt32 |
Event ID 574
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A17_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 578
#Fields #
| Name | Description |
|---|---|
A10_CurrentClusters Pointer | |
A11_CurrentClustersLsnQuadPart HexInt64 |
Event ID 579
#Fields #
| Name | Description |
|---|---|
A10_ClustersLinkAsHead Pointer | |
A11_FlagsToMatch HexInt32 | |
A12_InsertAfter UInt32 |
Event ID 583
#Event ID 584
#Fields #
| Name | Description |
|---|---|
A10_FlagOnClustersFlagsDEALLOCATED_CLUSTERS_FLAG_NO_DANGLING_MDL UInt32 | |
A11_Clusters Pointer | |
A12_Lcn HexInt64 | |
A13_ClusterCount HexInt64 |
Event ID 585
#Fields #
| Name | Description |
|---|---|
A10_FlagOnClustersFlagsDEALLOCATED_CLUSTERS_FLAG_NO_DANGLING_MDL UInt32 | |
A11_Clusters Pointer | |
A12_Lcn HexInt64 | |
A13_ClusterCount HexInt64 |
Event ID 586
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_TxfFcbFlags HexInt32 | |
A17_ShareMode HexInt32 |
Event ID 587
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_GrantedAccess HexInt32 |
Event ID 588
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_GrantedAccess HexInt32 |
Event ID 589
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_GrantedAccess HexInt32 | |
A17_NextTxfVscbReaderCleanupCount Int32 |
Event ID 590
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_CallerFunction AnsiString | |
A12_CallerFile AnsiString | |
A13_CallerLineNumber Int32 | |
A14_PVOIDTxfRmcb Pointer | |
A15__TxfRmcbRmId GUID | |
A16_PVOIDTxfTrans Pointer | |
A17__TxfTransKtmUow GUID | |
A18_AbortReasonStatus HexInt32 |
Event ID 591
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_CallerFunction AnsiString | |
A12_CallerFile AnsiString | |
A13_CallerLineNumber Int32 | |
A14_PVOIDTxfRmcb Pointer | |
A15__TxfRmcbRmId GUID | |
A16_PVOIDTxfTrans Pointer | |
A17__TxfTransKtmUow GUID | |
A18_Status HexInt32 |
Event ID 592
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_TxfTrans Pointer | |
A14__TxfTransKtmUow GUID |
Event ID 593
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_TxfTrans Pointer | |
A14__TxfTransKtmUow GUID |
Event ID 594
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDCalloutParametersTxfFlushTxfRmcb Pointer | |
A12__CalloutParametersTxfFlushTxfRmcbRmId GUID | |
A13_GetExceptionCode HexInt32 |
Event ID 605
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbTxfVcbFlags HexInt32 |
Event ID 606
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_TempStatus HexInt32 | |
A12_PVOIDVcb Pointer |
Event ID 607
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_GetExceptionCode HexInt32 | |
A12_Status HexInt32 | |
A13_PVOIDVcb Pointer |
Event ID 608
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDVcb Pointer | |
A12_TXF_MAX_RESET_ATTEMPTS_ON_MOUNT Int32 | |
A13_OldStatus HexInt32 |
Event ID 609
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_GetExceptionCode HexInt32 | |
A12_PVOIDVcb Pointer |
Event ID 610
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_NT_SUCCESSStatusSucceededFAILED AnsiString | |
A12_PVOIDTxfRmcb Pointer | |
A13__TxfRmcbRmId GUID | |
A14_Status HexInt32 |
Event ID 611
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 612
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 613
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 614
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbTxfVcbFlags HexInt32 |
Event ID 615
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 616
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbTxfVcbFlags HexInt32 |
Event ID 617
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 618
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_LogNestingLevel HexInt32 | |
A14_DiskNestingLevel HexInt32 |
Event ID 619
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 620
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 621
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13__ClfsRestartAreaRmId GUID |
Event ID 622
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_Status Int32 | |
A12_PVOIDTxfRmcb Pointer | |
A13__TxfRmcbRmId GUID |
Event ID 623
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 624
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 625
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 626
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_Status HexInt32 | |
A14_AbnormalTerminationabnormaltermination AnsiString |
Event ID 627
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_TxfIsDefaultRmTxfRmcbdefaultsecondary AnsiString | |
A12_PVOIDTxfRmcb Pointer | |
A13__TxfRmcbRmId GUID | |
A14_ForceDirtyShutdownDIRTYCLEAN AnsiString |
Event ID 628
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 629
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_FcbCleanupCount Int32 |
Event ID 630
#Fields #
| Name | Description |
|---|---|
A10_FILEID_FROM_SOURCEFileNLine UInt32 | |
A11_LINENUM_FROM_SOURCEFileNLine Int32 | |
A12_TxfRmcb Pointer | |
A13__TxfRmcbRmId GUID | |
A14_Status HexInt32 |
Event ID 631
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__OldGuid GUID | |
A13__TxfRmcbRmId GUID |
Event ID 632
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_PVOIDTxfTrans Pointer | |
A14__TxfTransKtmUow GUID | |
A15_Status HexInt32 |
Event ID 633
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__OldGuid GUID | |
A13__TxfRmcbRmId GUID |
Event ID 634
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_RmRootFcbVcb Pointer | |
A12__RmRootFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWRmRootFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHRmRootFcbVcbVpb CountedUtf16String | |
A14_RmRootFcb Pointer |
Event ID 635
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_BackupInfoFlags HexInt32 |
Event ID 636
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 637
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_Status HexInt32 | |
A12_PVOIDFileObject Pointer |
Event ID 638
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 639
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__CcbFullFileName CountedUtf16String | |
A19_CcbFlags HexInt32 |
Event ID 640
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_CcbTxfFo Pointer | |
A18_CcbTxfFoKtmTrans Pointer | |
A19_ScbFcbTxfRmcb Pointer | |
A20_CcbFullFileNameBuffer UnicodeString |
Event ID 641
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17__CcbFullFileName CountedUtf16String | |
A18_CcbAccessFlags HexInt32 | |
A19_FileObjectWriteAccess Int32 | |
A20_FileObjectDeleteAccess Int32 |
Event ID 642
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_ExceptionCode HexInt32 |
Event ID 643
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_TransactionNotification HexInt32 | |
A12_TransactionAlreadyPreparedPREPARED AnsiString | |
A13__TxfTransKtmUow GUID | |
A14_PVOIDTxfRmcb Pointer | |
A15__TxfRmcbRmId GUID | |
A16_Status HexInt32 |
Event ID 644
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_TxfTrans Pointer | |
A14__TxfTransKtmUow GUID |
Event ID 645
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_TxfTrans Pointer | |
A14__TxfTransKtmUow GUID |
Event ID 646
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTransTxfRmcb Pointer | |
A12__TransTxfRmcbRmId GUID | |
A13_FlushStatus HexInt32 |
Event ID 647
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_Trans Pointer | |
A14__TransKtmUow GUID |
Event ID 648
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_CallStack0 Pointer | |
A12_CallStack1 Pointer | |
A13_CallStack2 Pointer | |
A14_CallStack3 Pointer | |
A15_CallStack4 Pointer |
Event ID 649
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_Trans Pointer | |
A14__TransKtmUow GUID |
Event ID 650
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_Status HexInt32 | |
A12_PVOIDTrans Pointer | |
A13__TransKtmUow GUID | |
A14_PVOIDTxfRmcb Pointer | |
A15__TxfRmcbRmId GUID |
Event ID 651
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_Status HexInt32 | |
A12_PVOIDTxfRmcb Pointer | |
A13__TxfRmcbRmId GUID | |
A14_PVOIDTrans Pointer | |
A15__TransKtmUow GUID |
Event ID 652
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 653
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 654
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 655
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 656
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_OldestTrans Pointer | |
A14__OldestTransKtmUow GUID |
Event ID 657
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_Status HexInt32 | |
A14_OldestTrans Pointer | |
A15__OldestTransKtmUow GUID |
Event ID 658
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 659
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 660
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_PVOIDTransToDereference Pointer | |
A14__TransToDereferenceKtmUow GUID | |
A15_Status HexInt32 |
Event ID 661
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 662
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 663
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PinnedStatus HexInt32 | |
A12_PVOIDTxfRmcb Pointer | |
A13__TxfRmcbRmId GUID | |
A14_Status HexInt32 |
Event ID 664
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 665
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 666
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 667
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 668
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 669
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 670
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 671
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 672
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 673
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 674
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_IsEncrypted_TopsFcbInfoencryptedcompressed AnsiString |
Event ID 675
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 676
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 677
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 678
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 679
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 680
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 681
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 682
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 683
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 684
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_Fcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 685
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_VcbFirstValidUsn HexInt64 | |
A13_FirstValidUsn HexInt64 | |
A14_TrackUsnJournalFileSize HexInt64 | |
A15_TrackUsnJournalAllocationSize HexInt64 | |
A16_TrackUsnJournalMaxSize HexInt64 | |
A17_TrackUsnJournalDeltaAllocation HexInt64 |
Event ID 686
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_FirstValidUsn1 HexInt64 | |
A13_SavedReserved HexInt64 | |
A14_RequiredReserved HexInt64 |
Event ID 687
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_UsnJournalHeaderAllocationSizeQuadPart HexInt64 | |
A13_UsnJournalHeaderFileSizeQuadPart HexInt64 | |
A14_UsnJournalHeaderValidDataLengthQuadPart HexInt64 | |
A15_UsnJournalTotalAllocated HexInt64 |
Event ID 688
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_UsnJournalHeaderAllocationSizeQuadPart HexInt64 | |
A13_UsnJournalHeaderFileSizeQuadPart HexInt64 | |
A14_UsnJournalHeaderValidDataLengthQuadPart HexInt64 | |
A15_UsnJournalTotalAllocated HexInt64 |
Event ID 691
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_Fcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 |
Event ID 692
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A17_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 693
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_Fcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 694
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_ScbCleanupCount Int32 |
Event ID 695
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_IrpContextOriginatingIrp Pointer | |
A13_PsGetCurrentThread Pointer | |
A14_ScbHeaderAllocationSizeQuadPart HexInt64 | |
A15_ScbHeaderFileSizeQuadPart HexInt64 | |
A16_ScbHeaderValidDataLengthQuadPart HexInt64 | |
A17_NewAllocationSize HexInt64 |
Event ID 696
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_IrpContextOriginatingIrp Pointer | |
A13_PsGetCurrentThread Pointer | |
A14_ScbHeaderAllocationSizeQuadPart HexInt64 | |
A15_ScbHeaderFileSizeQuadPart HexInt64 | |
A16_ScbHeaderValidDataLengthQuadPart HexInt64 | |
A17_ScbTotalAllocated HexInt64 |
Event ID 697
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_IrpContextOriginatingIrp Pointer | |
A13_PsGetCurrentThread Pointer |
Event ID 698
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_IrpContextOriginatingIrp Pointer | |
A13_PsGetCurrentThread Pointer |
Event ID 699
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_IrpContextOriginatingIrp Pointer | |
A12_PsGetCurrentThread Pointer | |
A13_IrpContextExceptionStatus HexInt32 |
Event ID 700
#Fields #
| Name | Description |
|---|---|
A10_RemainingClusterCount HexInt64 | |
A11_Scb Pointer | |
A12_Vcn HexInt64 | |
A13_Lcn HexInt64 | |
A14_ClusterCount HexInt64 |
Event ID 708
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12__VolumeLabel CountedUtf16String | |
A13__VcbDeviceName CountedUtf16String |
Event ID 709
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Status HexInt32 | |
A12_FileReference Pointer | |
A13_Fcb Pointer | |
A14_Source HexInt64 | |
A15_TopLevelExceptionStatus HexInt32 |
Event ID 710
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_WasDirty HexInt32 | |
A12_NtfsFullSegmentNumber_BugCheckFileReference HexInt64 | |
A13_Source HexInt64 |
Event ID 711
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_Fcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_FsInformationClass HexInt32 | |
A18_Scb Pointer |
Event ID 712
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_Fcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_FsInformationClass HexInt32 | |
A18_Scb Pointer |
Event ID 713
#Fields #
| Name | Description |
|---|---|
A10_IrpSpParametersWriteByteOffsetHighPart HexInt32 | |
A11_IrpSpParametersWriteByteOffsetLowPart HexInt32 | |
A12_IrpContextTopLevelIrpContextExceptionStatus HexInt32 |
Event ID 715
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ByteRange HexInt64 | |
A15_HIGHEST_WRITABLE_SECTOR_ON_ACTIVE_VOLUMEVcbSectorSizeInfoLogicalBytesPerSector HexInt64 |