detection.wiki

mrcbt

EventTitleChannelSampleRule
1Driver Loaded version.UnknownNN
2Driver UnloadedUnknownNN
3The $LogFile restart count has changed on device DeviceName.UnknownNN
4Successfully attached to device DeviceName.UnknownNN
5Device DeviceName has been stopped (IRP_MN_STOP_DEVICE).UnknownNN
6Device DeviceName has been removed (IRP_MN_REMOVE_DEVICE).UnknownNN
7Device DeviceName has been surprise removed (IRP_MN_SURPRISE_REMOVAL).UnknownNN
8Tracking has been enabled on device DeviceName.UnknownNN
9Tracking has been disabled on device DeviceName.UnknownNN
10MRCBT has detected that Raxco Perfectdisk DefragFs has been scheduled to perform …UnknownNN
11Failed to enable tracking on device DeviceName.UnknownNN
12IRP_MJ_SHUTDOWN received on device DeviceName.UnknownNN
13IOCTL_MRCBT_QUERY_VOLUME_TRACKING_INFORMATION failed on device DeviceName with …UnknownNN
14Invalidating boot sector on device DeviceName.UnknownNN
15The NTFS $LogFile has been reset.UnknownNN
16Failed to allocate file buffer with size ReferenceCount for device DeviceName.UnknownNN
17Reading boot sector on device DeviceName.UnknownNN
18The file-system on device DeviceName is not supported.UnknownNN
19The volume DeviceName is offline.UnknownNN
20The file-system on device DeviceName is locked.UnknownNN
21Failed to create log file with status ErrorCode.UnknownNN
1000Received GUID_TARGET_DEVICE_REMOVE_COMPLETE for device DeviceName with …UnknownNN
1001Received GUID_IO_VOLUME_MOUNT for device DeviceName.UnknownNN
1002Received GUID_IO_VOLUME_DISMOUNT for device DeviceName.UnknownNN
1003Received GUID_IO_VOLUME_PHYSICAL_CONFIGURATION_CHANGE for device DeviceName.UnknownNN
1004Failed to initialize the tracking file on device DeviceName.UnknownNN
1005PlugPlay notification has been registered for device DeviceName with …UnknownNN
1006PlugPlay notification has been unregistered for device DeviceName with …UnknownNN
1007Received GUID_IO_VOLUME_LOCK_FAILED for device DeviceName.UnknownNN
1008Received GUID_IO_VOLUME_UNLOCK for device DeviceName.UnknownNN
1009Received GUID_TARGET_DEVICE_REMOVE_CANCELLED for device DeviceName.UnknownNN
1010Received GUID_TARGET_DEVICE_QUERY_REMOVE for device DeviceName.UnknownNN
1011Received GUID_IO_VOLUME_LOCK for device DeviceName.UnknownNN
1012Received GUID_IO_VOLUME_FVE_STATUS_CHANGE for device DeviceName.UnknownNN
1013IRP_MJ_READ failed on device DeviceName with status ReferenceCount.UnknownNN
1014IRP_MJ_WRITE failed on device DeviceName with status ReferenceCount.UnknownNN
1015Received GUID_IO_VOLUME_SIZE_CHANGE for device DeviceName.UnknownNN
1016Received GUID_IO_VOLUME_DISMOUNT_FAILED for device DeviceName.UnknownNN
1017Received GUID_IO_VOLUME_NEED_CHKDSK for device DeviceName.UnknownNN
2001Failed to open an existing tracking file on device DeviceName with status …UnknownNN
2002Failed to protect the tracking file on device DeviceName with status …UnknownNN
2003Failed to get retrieval pointers for the tracking file on device DeviceName with …UnknownNN
2004The tracking file on device DeviceName is corrupt.UnknownNN
2005Failed to create the tracking file on device DeviceName with status Status.UnknownNN
2006Failed to write to the tracking file on device DeviceName with status Status.UnknownNN
2007The checksum for the tracking file on device DeviceName is incorrect.UnknownNN
2008The previous session did not finalize the tracking file on device DeviceName.UnknownNN
2009Failed to reopen an existing tracking file on device DeviceName with status …UnknownNN
3001Received IRP_MN_SET_POWER with type of SystemPowerState and SystemState …UnknownNN
3002Received IRP_MN_SET_POWER with type of DevicePowerState and DeviceState …UnknownNN
3003Received IRP_MN_QUERY_POWER with type of SystemPowerState and SystemState …UnknownNN
3004Received IRP_MN_QUERY_POWER with type of DevicePowerState and DeviceState …UnknownNN
4004Received IRP_MJ_WRITE request at DISPATCH_LEVEL for device DeviceName.UnknownNN
5001An error was encountered while processing the Ntfs system metadata on line …UnknownNN
5002The size of the $LogFile on device DeviceName is Size bytes with Fragments …UnknownNN
5003Failed to read the $LogFile metadata for device DeviceName.UnknownNN
5004Failed to read Length bytes from device DeviceName with status Status.UnknownNN
5006MappingPairsLength=Length.UnknownNN
5007CurrentLcn=CurrentLcn, CurrentVcn=CurrentVcn, LcnBytes=LcnBytes, …UnknownNN
5008Detected Windows Sandbox Virtual Disk (DeviceName).UnknownNN
5009Detected Windows Xvdd Virtual Disk (DeviceName).UnknownNN
6001Detected ReFS version MajorVersion.UnknownNN
6002Found ReFS SuperBlock on device DeviceName.UnknownNN

Event ID 1: Driver Loaded version.

#
Channel
Unknown

Message #

Driver Loaded %1

Fields #

NameDescription
version AnsiString

Event ID 2: Driver Unloaded

#
Channel
Unknown

Event ID 3: The $LogFile restart count has changed on device DeviceName.

#
Channel
Unknown

Message #

The $LogFile restart count has changed on device %1

Fields #

NameDescription
DeviceName UnicodeString

Event ID 4: Successfully attached to device DeviceName.

#
Channel
Unknown

Message #

Successfully attached to device %1

Fields #

NameDescription
DeviceName UnicodeString

Event ID 5: Device DeviceName has been stopped (IRP_MN_STOP_DEVICE).

#
Channel
Unknown

Message #

Device %1 has been stopped (IRP_MN_STOP_DEVICE)

Fields #

NameDescription
DeviceName UnicodeString

Event ID 6: Device DeviceName has been removed (IRP_MN_REMOVE_DEVICE).

#
Channel
Unknown

Message #

Device %1 has been removed (IRP_MN_REMOVE_DEVICE)

Fields #

NameDescription
DeviceName UnicodeString

Event ID 7: Device DeviceName has been surprise removed (IRP_MN_SURPRISE_REMOVAL).

#
Channel
Unknown

Message #

Device %1 has been surprise removed (IRP_MN_SURPRISE_REMOVAL)

Fields #

NameDescription
DeviceName UnicodeString

Event ID 8: Tracking has been enabled on device DeviceName.

#
Channel
Unknown

Message #

Tracking has been enabled on device %1

Fields #

NameDescription
DeviceName UnicodeString

Event ID 9: Tracking has been disabled on device DeviceName.

#
Channel
Unknown

Message #

Tracking has been disabled on device %1

Fields #

NameDescription
DeviceName UnicodeString

Event ID 10: MRCBT has detected that Raxco Perfectdisk DefragFs has been scheduled to perform a boot-time defrag of one or more volumes.

#
Channel
Unknown

Message #

MRCBT has detected that Raxco Perfectdisk DefragFs has been scheduled to perform a boot-time defrag of one or more volumes. CBT will not be available until the system is rebooted without a boot-time defrag scheduled.

Event ID 11: Failed to enable tracking on device DeviceName.

#
Channel
Unknown

Message #

Failed to enable tracking on device %1

Fields #

NameDescription
DeviceName UnicodeString

Event ID 12: IRP_MJ_SHUTDOWN received on device DeviceName.

#
Channel
Unknown

Message #

IRP_MJ_SHUTDOWN received on device %1

Fields #

NameDescription
DeviceName UnicodeString

Event ID 13: IOCTL_MRCBT_QUERY_VOLUME_TRACKING_INFORMATION failed on device DeviceName with status Status.

#
Channel
Unknown

Message #

IOCTL_MRCBT_QUERY_VOLUME_TRACKING_INFORMATION failed on device %1 with status %2

Fields #

NameDescription
DeviceName UnicodeString
Status UInt32NTSTATUS reference

Event ID 14: Invalidating boot sector on device DeviceName.

#
Channel
Unknown

Message #

Invalidating boot sector on device %1

Fields #

NameDescription
DeviceName UnicodeString

Event ID 15: The NTFS $LogFile has been reset.

#
Channel
Unknown

Description

The NTFS $LogFile has been reset. This is normally caused by the Linux NTFS-3G driver.

Message #

The NTFS $LogFile has been reset. This is normally caused by the Linux NTFS-3G driver.

Fields #

NameDescription
DeviceName UnicodeString

Event ID 16: Failed to allocate file buffer with size ReferenceCount for device DeviceName.

#
Channel
Unknown

Message #

Failed to allocate file buffer with size %2 for device %1

Fields #

NameDescription
DeviceName UnicodeString
ReferenceCount UInt32

Event ID 17: Reading boot sector on device DeviceName.

#
Channel
Unknown

Message #

Reading boot sector on device %1

Fields #

NameDescription
DeviceName UnicodeString

Event ID 18: The file-system on device DeviceName is not supported.

#
Channel
Unknown

Message #

The file-system on device %1 is not supported

Fields #

NameDescription
DeviceName UnicodeString

Event ID 19: The volume DeviceName is offline.

#
Channel
Unknown

Message #

The volume %1 is offline

Fields #

NameDescription
DeviceName UnicodeString

Event ID 20: The file-system on device DeviceName is locked.

#
Channel
Unknown

Message #

The file-system on device %1 is locked

Fields #

NameDescription
DeviceName UnicodeString

Event ID 21: Failed to create log file with status ErrorCode.

#
Channel
Unknown

Message #

Failed to create log file with status %1

Fields #

NameDescription
ErrorCode UInt32

Event ID 1000: Received GUID_TARGET_DEVICE_REMOVE_COMPLETE for device DeviceName with ReferenceCount ReferenceCount.

#
Channel
Unknown

Message #

Received GUID_TARGET_DEVICE_REMOVE_COMPLETE for device %1 with ReferenceCount %2

Fields #

NameDescription
DeviceName UnicodeString
ReferenceCount UInt32

Event ID 1001: Received GUID_IO_VOLUME_MOUNT for device DeviceName.

#
Channel
Unknown

Message #

Received GUID_IO_VOLUME_MOUNT for device %1

Fields #

NameDescription
DeviceName UnicodeString

Event ID 1002: Received GUID_IO_VOLUME_DISMOUNT for device DeviceName.

#
Channel
Unknown

Message #

Received GUID_IO_VOLUME_DISMOUNT for device %1

Fields #

NameDescription
DeviceName UnicodeString

Event ID 1003: Received GUID_IO_VOLUME_PHYSICAL_CONFIGURATION_CHANGE for device DeviceName.

#
Channel
Unknown

Message #

Received GUID_IO_VOLUME_PHYSICAL_CONFIGURATION_CHANGE for device %1

Fields #

NameDescription
DeviceName UnicodeString

Event ID 1004: Failed to initialize the tracking file on device DeviceName.

#
Channel
Unknown

Message #

Failed to initialize the tracking file on device %1

Fields #

NameDescription
DeviceName UnicodeString

Event ID 1005: PlugPlay notification has been registered for device DeviceName with ReferenceCount ReferenceCount.

#
Channel
Unknown

Message #

PlugPlay notification has been registered for device %1 with ReferenceCount %2

Fields #

NameDescription
DeviceName UnicodeString
ReferenceCount UInt32

Event ID 1006: PlugPlay notification has been unregistered for device DeviceName with ReferenceCount ReferenceCount.

#
Channel
Unknown

Message #

PlugPlay notification has been unregistered for device %1 with ReferenceCount %2

Fields #

NameDescription
DeviceName UnicodeString
ReferenceCount UInt32

Event ID 1007: Received GUID_IO_VOLUME_LOCK_FAILED for device DeviceName.

#
Channel
Unknown

Message #

Received GUID_IO_VOLUME_LOCK_FAILED for device %1

Fields #

NameDescription
DeviceName UnicodeString

Event ID 1008: Received GUID_IO_VOLUME_UNLOCK for device DeviceName.

#
Channel
Unknown

Message #

Received GUID_IO_VOLUME_UNLOCK for device %1

Fields #

NameDescription
DeviceName UnicodeString

Event ID 1009: Received GUID_TARGET_DEVICE_REMOVE_CANCELLED for device DeviceName.

#
Channel
Unknown

Message #

Received GUID_TARGET_DEVICE_REMOVE_CANCELLED for device %1

Fields #

NameDescription
DeviceName UnicodeString

Event ID 1010: Received GUID_TARGET_DEVICE_QUERY_REMOVE for device DeviceName.

#
Channel
Unknown

Message #

Received GUID_TARGET_DEVICE_QUERY_REMOVE for device %1

Fields #

NameDescription
DeviceName UnicodeString

Event ID 1011: Received GUID_IO_VOLUME_LOCK for device DeviceName.

#
Channel
Unknown

Message #

Received GUID_IO_VOLUME_LOCK for device %1

Fields #

NameDescription
DeviceName UnicodeString

Event ID 1012: Received GUID_IO_VOLUME_FVE_STATUS_CHANGE for device DeviceName.

#
Channel
Unknown

Message #

Received GUID_IO_VOLUME_FVE_STATUS_CHANGE for device %1

Fields #

NameDescription
DeviceName UnicodeString

Event ID 1013: IRP_MJ_READ failed on device DeviceName with status ReferenceCount.

#
Channel
Unknown

Message #

IRP_MJ_READ failed on device %1 with status %2

Fields #

NameDescription
DeviceName UnicodeString
ReferenceCount UInt32

Event ID 1014: IRP_MJ_WRITE failed on device DeviceName with status ReferenceCount.

#
Channel
Unknown

Message #

IRP_MJ_WRITE failed on device %1 with status %2

Fields #

NameDescription
DeviceName UnicodeString
ReferenceCount UInt32

Event ID 1015: Received GUID_IO_VOLUME_SIZE_CHANGE for device DeviceName.

#
Channel
Unknown

Message #

Received GUID_IO_VOLUME_SIZE_CHANGE for device %1

Fields #

NameDescription
DeviceName UnicodeString

Event ID 1016: Received GUID_IO_VOLUME_DISMOUNT_FAILED for device DeviceName.

#
Channel
Unknown

Message #

Received GUID_IO_VOLUME_DISMOUNT_FAILED for device %1

Fields #

NameDescription
DeviceName UnicodeString

Event ID 1017: Received GUID_IO_VOLUME_NEED_CHKDSK for device DeviceName.

#
Channel
Unknown

Message #

Received GUID_IO_VOLUME_NEED_CHKDSK for device %1

Fields #

NameDescription
DeviceName UnicodeString

Event ID 2001: Failed to open an existing tracking file on device DeviceName with status ReferenceCount.

#
Channel
Unknown

Message #

Failed to open an existing tracking file on device %1 with status %2

Fields #

NameDescription
DeviceName UnicodeString
ReferenceCount UInt32

Event ID 2002: Failed to protect the tracking file on device DeviceName with status ReferenceCount.

#
Channel
Unknown

Message #

Failed to protect the tracking file on device %1 with status %2

Fields #

NameDescription
DeviceName UnicodeString
ReferenceCount UInt32

Event ID 2003: Failed to get retrieval pointers for the tracking file on device DeviceName with status ReferenceCount.

#
Channel
Unknown

Message #

Failed to get retrieval pointers for the tracking file on device %1 with status %2

Fields #

NameDescription
DeviceName UnicodeString
ReferenceCount UInt32

Event ID 2004: The tracking file on device DeviceName is corrupt.

#
Channel
Unknown

Message #

The tracking file on device %1 is corrupt

Fields #

NameDescription
DeviceName UnicodeString

Event ID 2005: Failed to create the tracking file on device DeviceName with status Status.

#
Channel
Unknown

Message #

Failed to create the tracking file on device %1 with status %2

Fields #

NameDescription
DeviceName UnicodeString
Status UInt32NTSTATUS reference

Event ID 2006: Failed to write to the tracking file on device DeviceName with status Status.

#
Channel
Unknown

Message #

Failed to write to the tracking file on device %1 with status %2

Fields #

NameDescription
DeviceName UnicodeString
Status UInt32NTSTATUS reference

Event ID 2007: The checksum for the tracking file on device DeviceName is incorrect.

#
Channel
Unknown

Description

The checksum for the tracking file on device DeviceName is incorrect. The tracking file has been reset.

Message #

The checksum for the tracking file on device %1 is incorrect. The tracking file has been reset.

Fields #

NameDescription
DeviceName UnicodeString

Event ID 2008: The previous session did not finalize the tracking file on device DeviceName.

#
Channel
Unknown

Description

The previous session did not finalize the tracking file on device DeviceName. The tracking file has been reset.

Message #

The previous session did not finalize the tracking file on device %1. The tracking file has been reset.

Fields #

NameDescription
DeviceName UnicodeString

Event ID 2009: Failed to reopen an existing tracking file on device DeviceName with status ReferenceCount.

#
Channel
Unknown

Message #

Failed to reopen an existing tracking file on device %1 with status %2

Fields #

NameDescription
DeviceName UnicodeString
ReferenceCount UInt32

Event ID 3001: Received IRP_MN_SET_POWER with type of SystemPowerState and SystemState ReferenceCount for device DeviceName.

#
Channel
Unknown

Message #

Received IRP_MN_SET_POWER with type of SystemPowerState and SystemState %2 for device %1

Fields #

NameDescription
DeviceName UnicodeString
ReferenceCount UInt32

Event ID 3002: Received IRP_MN_SET_POWER with type of DevicePowerState and DeviceState ReferenceCount for device DeviceName.

#
Channel
Unknown

Message #

Received IRP_MN_SET_POWER with type of DevicePowerState and DeviceState %2 for device %1

Fields #

NameDescription
DeviceName UnicodeString
ReferenceCount UInt32

Event ID 3003: Received IRP_MN_QUERY_POWER with type of SystemPowerState and SystemState ReferenceCount for device DeviceName.

#
Channel
Unknown

Message #

Received IRP_MN_QUERY_POWER with type of SystemPowerState and SystemState %2 for device %1

Fields #

NameDescription
DeviceName UnicodeString
ReferenceCount UInt32

Event ID 3004: Received IRP_MN_QUERY_POWER with type of DevicePowerState and DeviceState ReferenceCount for device DeviceName.

#
Channel
Unknown

Message #

Received IRP_MN_QUERY_POWER with type of DevicePowerState and DeviceState %2 for device %1

Fields #

NameDescription
DeviceName UnicodeString
ReferenceCount UInt32

Event ID 4004: Received IRP_MJ_WRITE request at DISPATCH_LEVEL for device DeviceName.

#
Channel
Unknown

Message #

Received IRP_MJ_WRITE request at DISPATCH_LEVEL for device %1. You are receiving this warning because a third-party filter driver has generated an illegitimate request and CBT has been forced to take appropriate steps to avoid generating a system crash. This will not effect the integrity of your backups, but is an indication that you are possibly running faulty third-party software. This message will no longer be displayed for this volume during this session.

Fields #

NameDescription
DeviceName UnicodeString

Event ID 5001: An error was encountered while processing the Ntfs system metadata on line SourceLine.

#
Channel
Unknown

Description

An error was encountered while processing the Ntfs system metadata on line SourceLine. Status Status.

Message #

An error was encountered while processing the Ntfs system metadata on line %1. Status %2.

Fields #

NameDescription
SourceLine UInt32
Status UInt32NTSTATUS reference

Event ID 5002: The size of the $LogFile on device DeviceName is Size bytes with Fragments fragments.

#
Channel
Unknown

Message #

The size of the $LogFile on device %1 is %2 bytes with %3 fragments

Fields #

NameDescription
DeviceName UnicodeString
Size HexInt32
Fragments HexInt32

Event ID 5003: Failed to read the $LogFile metadata for device DeviceName.

#
Channel
Unknown

Message #

Failed to read the $LogFile metadata for device %1

Fields #

NameDescription
DeviceName UnicodeString

Event ID 5004: Failed to read Length bytes from device DeviceName with status Status.

#
Channel
Unknown

Message #

Failed to read %1 bytes from device %2 with status %3

Fields #

NameDescription
Length UInt32
DeviceName UnicodeString
Status UInt32NTSTATUS reference

Event ID 5006: MappingPairsLength=Length.

#
Channel
Unknown

Message #

MappingPairsLength=%1

Fields #

NameDescription
Length UInt32

Event ID 5007: CurrentLcn=CurrentLcn, CurrentVcn=CurrentVcn, LcnBytes=LcnBytes, VcnBytes=VcnBytes.

#
Channel
Unknown

Message #

CurrentLcn=%1, CurrentVcn=%2, LcnBytes=%3, VcnBytes=%4

Fields #

NameDescription
CurrentLcn UInt32
CurrentVcn UInt32
LcnBytes UInt32
VcnBytes UInt32

Event ID 5008: Detected Windows Sandbox Virtual Disk (DeviceName).

#
Channel
Unknown

Description

Detected Windows Sandbox Virtual Disk (DeviceName). Tracking will not be available on this device.

Message #

Detected Windows Sandbox Virtual Disk (%1). Tracking will not be available on this device.

Fields #

NameDescription
DeviceName UnicodeString

Event ID 5009: Detected Windows Xvdd Virtual Disk (DeviceName).

#
Channel
Unknown

Description

Detected Windows Xvdd Virtual Disk (DeviceName). Tracking will not be available on this device.

Message #

Detected Windows Xvdd Virtual Disk (%1). Tracking will not be available on this device.

Fields #

NameDescription
DeviceName UnicodeString

Event ID 6001: Detected ReFS version MajorVersion.

#
Channel
Unknown

Description

Detected ReFS version MajorVersion.MinorVersion boot sector sector on device DeviceName.

Message #

Detected ReFS version %1.%2 boot sector sector on device %3

Fields #

NameDescription
MajorVersion UInt32
MinorVersion UInt32
DeviceName UnicodeString

Event ID 6002: Found ReFS SuperBlock on device DeviceName.

#
Channel
Unknown

Message #

Found ReFS SuperBlock on device %1

Fields #

NameDescription
DeviceName UnicodeString