Microsoft-Windows-FileHistory-UI

48 events across 3 channels

Event	Title	Channel
1	Info	Debug
2	ApplicationStart	Analytic
3	ApplicationStartStop	Analytic
4	BackButtonNavigationStart	Analytic
5	BackButtonNavigationStop	Analytic
6	ForwardButtonNavigationStart	Analytic
7	ForwardButtonNavigationStop	Analytic
8	UpButtonNavigationStart	Analytic
9	UpButtonNavigationStop	Analytic
10	HomeButtonNavigationStart	Analytic
11	HomeButtonNavigationStop	Analytic
12	RefreshButtonNavigationStart	Analytic
13	RefreshButtonNavigationStop	Analytic
14	ZoomSwitch3To1Start	Analytic
15	ZoomSwitch3To1Stop	Analytic
16	ZoomSwitch1To3Start	Analytic
17	ZoomSwitch1To3Stop	Analytic
18	FolderViewTypeSwitchToContentStart	Analytic
19	FolderViewTypeSwitchToContentStop	Analytic
20	FolderViewTypeSwitchToPropertiesStart	Analytic
21	FolderViewTypeSwitchToPropertiesStop	Analytic
22	FolderViewStyleSwitchToLargeIconsStart	Analytic
23	FolderViewStyleSwitchToLargeIconsStop	Analytic
24	FolderViewStyleSwitchToDetailsStart	Analytic
25	FolderViewStyleSwitchToDetailsStop	Analytic
26	PreviewListScrollStart	Analytic
27	PreviewListScrollStop	Analytic
30	FolderDoubleClickNavigationStart	Analytic
31	FolderDoubleClickNavigationStop	Analytic
36	SettingsDialogOpensFromToolbarStart	Analytic
37	SettingsDialogOpensFromToolbarStop	Analytic
38	AllVisiblePreviewsVisuallyReadyStart	Analytic
39	AllVisiblePreviewsVisuallyReadyStop	Analytic
44	ZoomSwitchGenericStart	Analytic
45	ZoomSwitchGenericStop	Analytic
56	LibraryTimelineEnumConstructionStart	Analytic
57	LibraryTimelineEnumConstructionStop	Analytic
58	LibraryTimelineEnumIterationStart	Analytic
59	LibraryTimelineEnumIterationStop	Analytic
60	LaunchStart	Analytic
61	LaunchStop	Analytic
62	ViewRenderedStart	Analytic
63	ViewRenderedStop	Analytic
64	SearchViewRenderedStart	Analytic
65	SearchViewRenderedStop	Analytic
66	RestoreCompletedStart	Analytic
67	RestoreCompletedStop	Analytic
68	Restore destination was unavailable: Message.	BackupLog

Event ID 1: Info

Provider: Microsoft-Windows-FileHistory-UI
Channel: Debug
Task: Info

Fields #

Name	Description
`Message` UnicodeString

Event ID 2: ApplicationStart

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: ApplicationStart
Opcode: Start

Event ID 3: ApplicationStartStop

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: ApplicationStart
Opcode: Stop

Event ID 4: BackButtonNavigationStart

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: BackButtonNavigation
Opcode: Start

Event ID 5: BackButtonNavigationStop

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: BackButtonNavigation
Opcode: Stop

Event ID 6: ForwardButtonNavigationStart

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: ForwardButtonNavigation
Opcode: Start

Event ID 7: ForwardButtonNavigationStop

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: ForwardButtonNavigation
Opcode: Stop

Event ID 8: UpButtonNavigationStart

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: UpButtonNavigation
Opcode: Start

Event ID 9: UpButtonNavigationStop

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: UpButtonNavigation
Opcode: Stop

Event ID 10: HomeButtonNavigationStart

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: HomeButtonNavigation
Opcode: Start

Event ID 11: HomeButtonNavigationStop

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: HomeButtonNavigation
Opcode: Stop

Event ID 12: RefreshButtonNavigationStart

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: RefreshButtonNavigation
Opcode: Start

Event ID 13: RefreshButtonNavigationStop

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: RefreshButtonNavigation
Opcode: Stop

Event ID 14: ZoomSwitch3To1Start

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: ZoomSwitch3To1
Opcode: Start

Event ID 15: ZoomSwitch3To1Stop

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: ZoomSwitch3To1
Opcode: Stop

Event ID 16: ZoomSwitch1To3Start

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: ZoomSwitch1To3
Opcode: Start

Event ID 17: ZoomSwitch1To3Stop

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: ZoomSwitch1To3
Opcode: Stop

Event ID 18: FolderViewTypeSwitchToContentStart

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: FolderViewTypeSwitchToContent
Opcode: Start

Event ID 19: FolderViewTypeSwitchToContentStop

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: FolderViewTypeSwitchToContent
Opcode: Stop

Event ID 20: FolderViewTypeSwitchToPropertiesStart

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: FolderViewTypeSwitchToProperties
Opcode: Start

Event ID 21: FolderViewTypeSwitchToPropertiesStop

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: FolderViewTypeSwitchToProperties
Opcode: Stop

Event ID 22: FolderViewStyleSwitchToLargeIconsStart

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: FolderViewStyleSwitchToLargeIcons
Opcode: Start

Event ID 23: FolderViewStyleSwitchToLargeIconsStop

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: FolderViewStyleSwitchToLargeIcons
Opcode: Stop

Event ID 24: FolderViewStyleSwitchToDetailsStart

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: FolderViewStyleSwitchToDetails
Opcode: Start

Event ID 25: FolderViewStyleSwitchToDetailsStop

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: FolderViewStyleSwitchToDetails
Opcode: Stop

Event ID 26: PreviewListScrollStart

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: PreviewListScroll
Opcode: Start

Event ID 27: PreviewListScrollStop

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: PreviewListScroll
Opcode: Stop

Event ID 30: FolderDoubleClickNavigationStart

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: FolderDoubleClickNavigation
Opcode: Start

Event ID 31: FolderDoubleClickNavigationStop

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: FolderDoubleClickNavigation
Opcode: Stop

Event ID 36: SettingsDialogOpensFromToolbarStart

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: SettingsDialogOpensFromToolbar
Opcode: Start

Event ID 37: SettingsDialogOpensFromToolbarStop

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: SettingsDialogOpensFromToolbar
Opcode: Stop

Event ID 38: AllVisiblePreviewsVisuallyReadyStart

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: AllVisiblePreviewsVisuallyReady
Opcode: Start

Event ID 39: AllVisiblePreviewsVisuallyReadyStop

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: AllVisiblePreviewsVisuallyReady
Opcode: Stop

Event ID 44: ZoomSwitchGenericStart

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: ZoomSwitchGeneric
Opcode: Start

Event ID 45: ZoomSwitchGenericStop

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: ZoomSwitchGeneric
Opcode: Stop

Event ID 56: LibraryTimelineEnumConstructionStart

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: LibraryTimelineEnumConstruction
Opcode: Start

Event ID 57: LibraryTimelineEnumConstructionStop

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: LibraryTimelineEnumConstruction
Opcode: Stop

Event ID 58: LibraryTimelineEnumIterationStart

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: LibraryTimelineEnumIteration
Opcode: Start

Event ID 59: LibraryTimelineEnumIterationStop

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: LibraryTimelineEnumIteration
Opcode: Stop

Event ID 60: LaunchStart

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: Launch
Opcode: Start

Fields #

Name	Description
`CommandLineParameters` UnicodeString

Event ID 61: LaunchStop

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: Launch
Opcode: Stop

Fields #

Name	Description
`CommandLineParameters` UnicodeString

Event ID 62: ViewRenderedStart

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: ViewRendered
Opcode: Start

Event ID 63: ViewRenderedStop

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: ViewRendered
Opcode: Stop

Event ID 64: SearchViewRenderedStart

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: SearchViewRendered
Opcode: Start

Fields #

Name	Description
`SearchFlags` UInt32

Event ID 65: SearchViewRenderedStop

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: SearchViewRendered
Opcode: Stop

Fields #

Name	Description
`SearchFlags` UInt32

Event ID 66: RestoreCompletedStart

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: RestoreCompleted
Opcode: Start

Event ID 67: RestoreCompletedStop

Provider: Microsoft-Windows-FileHistory-UI
Channel: Analytic
Task: RestoreCompleted
Opcode: Stop

Event ID 68: Restore destination was unavailable: Message.

Provider: Microsoft-Windows-FileHistory-UI
Channel: BackupLog
Task: Info

Description

Restore destination was unavailable: Message.

Message #

Restore destination was unavailable: %1

Fields #

Name	Description
`Message` UnicodeString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID b447b4e1-7780-11e0-ada3-18a90531a85a

Defined in fhuxcommon.dll, which carries the event manifest.

Observed on:

Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.3037 · captured 2026-06-02

Downloads

Microsoft-Windows-FileHistory-UI registered manifest XML (Win11-26200.6584) manifest-xml

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)