Microsoft-Windows-NtfsLog_cdac24ce683a371108c05bb363714355
708 events across 1 channel
| Event | Title | Channel |
|---|---|---|
| 10 | Event ID 10 | Operational |
| 11 | Event ID 11 | Operational |
| 12 | Event ID 12 | Operational |
| 13 | Event ID 13 | Operational |
| 14 | Event ID 14 | Operational |
| 15 | Event ID 15 | Operational |
| 16 | Event ID 16 | Operational |
| 17 | Event ID 17 | Operational |
| 18 | Event ID 18 | Operational |
| 19 | Event ID 19 | Operational |
| 20 | Event ID 20 | Operational |
| 21 | Event ID 21 | Operational |
| 22 | Event ID 22 | Operational |
| 23 | Event ID 23 | Operational |
| 24 | Event ID 24 | Operational |
| 25 | Event ID 25 | Operational |
| 26 | Event ID 26 | Operational |
| 27 | Event ID 27 | Operational |
| 28 | Event ID 28 | Operational |
| 29 | Event ID 29 | Operational |
| 30 | Event ID 30 | Operational |
| 31 | Event ID 31 | Operational |
| 32 | Event ID 32 | Operational |
| 33 | Event ID 33 | Operational |
| 34 | Event ID 34 | Operational |
| 35 | Event ID 35 | Operational |
| 36 | Event ID 36 | Operational |
| 37 | Event ID 37 | Operational |
| 38 | Event ID 38 | Operational |
| 39 | Event ID 39 | Operational |
| 40 | Event ID 40 | Operational |
| 41 | Event ID 41 | Operational |
| 42 | Event ID 42 | Operational |
| 43 | Event ID 43 | Operational |
| 44 | Event ID 44 | Operational |
| 45 | Event ID 45 | Operational |
| 46 | Event ID 46 | Operational |
| 47 | Event ID 47 | Operational |
| 48 | Event ID 48 | Operational |
| 49 | Event ID 49 | Operational |
| 50 | Event ID 50 | Operational |
| 51 | Event ID 51 | Operational |
| 52 | Event ID 52 | Operational |
| 53 | Event ID 53 | Operational |
| 54 | Event ID 54 | Operational |
| 55 | Event ID 55 | Operational |
| 56 | Event ID 56 | Operational |
| 57 | Event ID 57 | Operational |
| 58 | Event ID 58 | Operational |
| 59 | Event ID 59 | Operational |
| 60 | Event ID 60 | Operational |
| 61 | Event ID 61 | Operational |
| 62 | Event ID 62 | Operational |
| 63 | Event ID 63 | Operational |
| 64 | Event ID 64 | Operational |
| 65 | Event ID 65 | Operational |
| 66 | Event ID 66 | Operational |
| 67 | Event ID 67 | Operational |
| 68 | Event ID 68 | Operational |
| 69 | Event ID 69 | Operational |
| 70 | Event ID 70 | Operational |
| 71 | Event ID 71 | Operational |
| 72 | Event ID 72 | Operational |
| 73 | Event ID 73 | Operational |
| 74 | Event ID 74 | Operational |
| 75 | Event ID 75 | Operational |
| 76 | Event ID 76 | Operational |
| 77 | Event ID 77 | Operational |
| 78 | Event ID 78 | Operational |
| 79 | Event ID 79 | Operational |
| 80 | Event ID 80 | Operational |
| 81 | Event ID 81 | Operational |
| 82 | Event ID 82 | Operational |
| 83 | Event ID 83 | Operational |
| 84 | Event ID 84 | Operational |
| 85 | Event ID 85 | Operational |
| 86 | Event ID 86 | Operational |
| 87 | Event ID 87 | Operational |
| 88 | Event ID 88 | Operational |
| 89 | Event ID 89 | Operational |
| 90 | Event ID 90 | Operational |
| 91 | Event ID 91 | Operational |
| 92 | Event ID 92 | Operational |
| 93 | Event ID 93 | Operational |
| 94 | Event ID 94 | Operational |
| 95 | Event ID 95 | Operational |
| 96 | Event ID 96 | Operational |
| 97 | Event ID 97 | Operational |
| 98 | Event ID 98 | Operational |
| 99 | Event ID 99 | Operational |
| 100 | Event ID 100 | Operational |
| 101 | Event ID 101 | Operational |
| 102 | Event ID 102 | Operational |
| 103 | Event ID 103 | Operational |
| 104 | Event ID 104 | Operational |
| 105 | Event ID 105 | Operational |
| 106 | Event ID 106 | Operational |
| 107 | Event ID 107 | Operational |
| 108 | Event ID 108 | Operational |
| 109 | Event ID 109 | Operational |
| 110 | Event ID 110 | Operational |
| 111 | Event ID 111 | Operational |
| 112 | Event ID 112 | Operational |
| 113 | Event ID 113 | Operational |
| 114 | Event ID 114 | Operational |
| 115 | Event ID 115 | Operational |
| 116 | Event ID 116 | Operational |
| 117 | Event ID 117 | Operational |
| 118 | Event ID 118 | Operational |
| 119 | Event ID 119 | Operational |
| 120 | Event ID 120 | Operational |
| 121 | Event ID 121 | Operational |
| 122 | Event ID 122 | Operational |
| 123 | Event ID 123 | Operational |
| 124 | Event ID 124 | Operational |
| 125 | Event ID 125 | Operational |
| 126 | Event ID 126 | Operational |
| 127 | Event ID 127 | Operational |
| 128 | Event ID 128 | Operational |
| 129 | Event ID 129 | Operational |
| 130 | Event ID 130 | Operational |
| 131 | Event ID 131 | Operational |
| 132 | Event ID 132 | Operational |
| 133 | Event ID 133 | Operational |
| 134 | Event ID 134 | Operational |
| 135 | Event ID 135 | Operational |
| 136 | Event ID 136 | Operational |
| 137 | Event ID 137 | Operational |
| 138 | Event ID 138 | Operational |
| 139 | Event ID 139 | Operational |
| 140 | Event ID 140 | Operational |
| 141 | Event ID 141 | Operational |
| 142 | Event ID 142 | Operational |
| 143 | Event ID 143 | Operational |
| 144 | Event ID 144 | Operational |
| 145 | Event ID 145 | Operational |
| 146 | Event ID 146 | Operational |
| 147 | Event ID 147 | Operational |
| 148 | Event ID 148 | Operational |
| 149 | Event ID 149 | Operational |
| 150 | Event ID 150 | Operational |
| 151 | Event ID 151 | Operational |
| 152 | Event ID 152 | Operational |
| 153 | Event ID 153 | Operational |
| 154 | Event ID 154 | Operational |
| 155 | Event ID 155 | Operational |
| 156 | Event ID 156 | Operational |
| 157 | Event ID 157 | Operational |
| 158 | Event ID 158 | Operational |
| 159 | Event ID 159 | Operational |
| 160 | Event ID 160 | Operational |
| 161 | Event ID 161 | Operational |
| 162 | Event ID 162 | Operational |
| 163 | Event ID 163 | Operational |
| 164 | Event ID 164 | Operational |
| 165 | Event ID 165 | Operational |
| 166 | Event ID 166 | Operational |
| 167 | Event ID 167 | Operational |
| 168 | Event ID 168 | Operational |
| 169 | Event ID 169 | Operational |
| 170 | Event ID 170 | Operational |
| 171 | Event ID 171 | Operational |
| 172 | Event ID 172 | Operational |
| 173 | Event ID 173 | Operational |
| 174 | Event ID 174 | Operational |
| 175 | Event ID 175 | Operational |
| 176 | Event ID 176 | Operational |
| 177 | Event ID 177 | Operational |
| 178 | Event ID 178 | Operational |
| 179 | Event ID 179 | Operational |
| 180 | Event ID 180 | Operational |
| 181 | Event ID 181 | Operational |
| 182 | Event ID 182 | Operational |
| 183 | Event ID 183 | Operational |
| 184 | Event ID 184 | Operational |
| 185 | Event ID 185 | Operational |
| 186 | Event ID 186 | Operational |
| 187 | Event ID 187 | Operational |
| 188 | Event ID 188 | Operational |
| 189 | Event ID 189 | Operational |
| 190 | Event ID 190 | Operational |
| 191 | Event ID 191 | Operational |
| 192 | Event ID 192 | Operational |
| 193 | Event ID 193 | Operational |
| 194 | Event ID 194 | Operational |
| 195 | Event ID 195 | Operational |
| 196 | Event ID 196 | Operational |
| 197 | Event ID 197 | Operational |
| 198 | Event ID 198 | Operational |
| 199 | Event ID 199 | Operational |
| 200 | Event ID 200 | Operational |
| 201 | Event ID 201 | Operational |
| 202 | Event ID 202 | Operational |
| 203 | Event ID 203 | Operational |
| 204 | Event ID 204 | Operational |
| 205 | Event ID 205 | Operational |
| 206 | Event ID 206 | Operational |
| 207 | Event ID 207 | Operational |
| 208 | Event ID 208 | Operational |
| 209 | Event ID 209 | Operational |
| 210 | Event ID 210 | Operational |
| 211 | Event ID 211 | Operational |
| 212 | Event ID 212 | Operational |
| 213 | Event ID 213 | Operational |
| 214 | Event ID 214 | Operational |
| 215 | Event ID 215 | Operational |
| 216 | Event ID 216 | Operational |
| 217 | Event ID 217 | Operational |
| 218 | Event ID 218 | Operational |
| 219 | Event ID 219 | Operational |
| 220 | Event ID 220 | Operational |
| 221 | Event ID 221 | Operational |
| 222 | Event ID 222 | Operational |
| 223 | Event ID 223 | Operational |
| 224 | Event ID 224 | Operational |
| 225 | Event ID 225 | Operational |
| 226 | Event ID 226 | Operational |
| 227 | Event ID 227 | Operational |
| 228 | Event ID 228 | Operational |
| 229 | Event ID 229 | Operational |
| 230 | Event ID 230 | Operational |
| 231 | Event ID 231 | Operational |
| 232 | Event ID 232 | Operational |
| 233 | Event ID 233 | Operational |
| 234 | Event ID 234 | Operational |
| 235 | Event ID 235 | Operational |
| 236 | Event ID 236 | Operational |
| 237 | Event ID 237 | Operational |
| 238 | Event ID 238 | Operational |
| 239 | Event ID 239 | Operational |
| 240 | Event ID 240 | Operational |
| 241 | Event ID 241 | Operational |
| 242 | Event ID 242 | Operational |
| 243 | Event ID 243 | Operational |
| 244 | Event ID 244 | Operational |
| 245 | Event ID 245 | Operational |
| 246 | Event ID 246 | Operational |
| 247 | Event ID 247 | Operational |
| 248 | Event ID 248 | Operational |
| 249 | Event ID 249 | Operational |
| 250 | Event ID 250 | Operational |
| 251 | Event ID 251 | Operational |
| 252 | Event ID 252 | Operational |
| 253 | Event ID 253 | Operational |
| 254 | Event ID 254 | Operational |
| 255 | Event ID 255 | Operational |
| 256 | Event ID 256 | Operational |
| 257 | Event ID 257 | Operational |
| 258 | Event ID 258 | Operational |
| 259 | Event ID 259 | Operational |
| 260 | Event ID 260 | Operational |
| 261 | Event ID 261 | Operational |
| 262 | Event ID 262 | Operational |
| 263 | Event ID 263 | Operational |
| 264 | Event ID 264 | Operational |
| 265 | Event ID 265 | Operational |
| 266 | Event ID 266 | Operational |
| 267 | Event ID 267 | Operational |
| 268 | Event ID 268 | Operational |
| 269 | Event ID 269 | Operational |
| 270 | Event ID 270 | Operational |
| 271 | Event ID 271 | Operational |
| 272 | Event ID 272 | Operational |
| 273 | Event ID 273 | Operational |
| 274 | Event ID 274 | Operational |
| 275 | Event ID 275 | Operational |
| 276 | Event ID 276 | Operational |
| 277 | Event ID 277 | Operational |
| 278 | Event ID 278 | Operational |
| 279 | Event ID 279 | Operational |
| 280 | Event ID 280 | Operational |
| 281 | Event ID 281 | Operational |
| 282 | Event ID 282 | Operational |
| 283 | Event ID 283 | Operational |
| 284 | Event ID 284 | Operational |
| 285 | Event ID 285 | Operational |
| 286 | Event ID 286 | Operational |
| 287 | Event ID 287 | Operational |
| 288 | Event ID 288 | Operational |
| 289 | Event ID 289 | Operational |
| 290 | Event ID 290 | Operational |
| 291 | Event ID 291 | Operational |
| 292 | Event ID 292 | Operational |
| 293 | Event ID 293 | Operational |
| 294 | Event ID 294 | Operational |
| 295 | Event ID 295 | Operational |
| 296 | Event ID 296 | Operational |
| 297 | Event ID 297 | Operational |
| 298 | Event ID 298 | Operational |
| 299 | Event ID 299 | Operational |
| 300 | Event ID 300 | Operational |
| 301 | Event ID 301 | Operational |
| 302 | Event ID 302 | Operational |
| 303 | Event ID 303 | Operational |
| 304 | Event ID 304 | Operational |
| 305 | Event ID 305 | Operational |
| 306 | Event ID 306 | Operational |
| 307 | Event ID 307 | Operational |
| 308 | Event ID 308 | Operational |
| 309 | Event ID 309 | Operational |
| 310 | Event ID 310 | Operational |
| 311 | Event ID 311 | Operational |
| 312 | Event ID 312 | Operational |
| 313 | Event ID 313 | Operational |
| 314 | Event ID 314 | Operational |
| 315 | Event ID 315 | Operational |
| 316 | Event ID 316 | Operational |
| 317 | Event ID 317 | Operational |
| 318 | Event ID 318 | Operational |
| 319 | Event ID 319 | Operational |
| 320 | Event ID 320 | Operational |
| 321 | Event ID 321 | Operational |
| 322 | Event ID 322 | Operational |
| 323 | Event ID 323 | Operational |
| 324 | Event ID 324 | Operational |
| 325 | Event ID 325 | Operational |
| 326 | Event ID 326 | Operational |
| 327 | Event ID 327 | Operational |
| 328 | Event ID 328 | Operational |
| 329 | Event ID 329 | Operational |
| 330 | Event ID 330 | Operational |
| 331 | Event ID 331 | Operational |
| 332 | Event ID 332 | Operational |
| 333 | Event ID 333 | Operational |
| 334 | Event ID 334 | Operational |
| 335 | Event ID 335 | Operational |
| 336 | Event ID 336 | Operational |
| 337 | Event ID 337 | Operational |
| 338 | Event ID 338 | Operational |
| 339 | Event ID 339 | Operational |
| 340 | Event ID 340 | Operational |
| 341 | Event ID 341 | Operational |
| 342 | Event ID 342 | Operational |
| 343 | Event ID 343 | Operational |
| 344 | Event ID 344 | Operational |
| 345 | Event ID 345 | Operational |
| 346 | Event ID 346 | Operational |
| 347 | Event ID 347 | Operational |
| 348 | Event ID 348 | Operational |
| 349 | Event ID 349 | Operational |
| 350 | Event ID 350 | Operational |
| 351 | Event ID 351 | Operational |
| 352 | Event ID 352 | Operational |
| 353 | Event ID 353 | Operational |
| 354 | Event ID 354 | Operational |
| 355 | Event ID 355 | Operational |
| 356 | Event ID 356 | Operational |
| 357 | Event ID 357 | Operational |
| 358 | Event ID 358 | Operational |
| 359 | Event ID 359 | Operational |
| 360 | Event ID 360 | Operational |
| 361 | Event ID 361 | Operational |
| 362 | Event ID 362 | Operational |
| 363 | Event ID 363 | Operational |
| 364 | Event ID 364 | Operational |
| 365 | Event ID 365 | Operational |
| 366 | Event ID 366 | Operational |
| 367 | Event ID 367 | Operational |
| 368 | Event ID 368 | Operational |
| 369 | Event ID 369 | Operational |
| 370 | Event ID 370 | Operational |
| 371 | Event ID 371 | Operational |
| 372 | Event ID 372 | Operational |
| 373 | Event ID 373 | Operational |
| 374 | Event ID 374 | Operational |
| 375 | Event ID 375 | Operational |
| 376 | Event ID 376 | Operational |
| 377 | Event ID 377 | Operational |
| 378 | Event ID 378 | Operational |
| 379 | Event ID 379 | Operational |
| 380 | Event ID 380 | Operational |
| 381 | Event ID 381 | Operational |
| 382 | Event ID 382 | Operational |
| 383 | Event ID 383 | Operational |
| 384 | Event ID 384 | Operational |
| 385 | Event ID 385 | Operational |
| 386 | Event ID 386 | Operational |
| 387 | Event ID 387 | Operational |
| 388 | Event ID 388 | Operational |
| 389 | Event ID 389 | Operational |
| 390 | Event ID 390 | Operational |
| 391 | Event ID 391 | Operational |
| 392 | Event ID 392 | Operational |
| 393 | Event ID 393 | Operational |
| 394 | Event ID 394 | Operational |
| 395 | Event ID 395 | Operational |
| 396 | Event ID 396 | Operational |
| 397 | Event ID 397 | Operational |
| 398 | Event ID 398 | Operational |
| 399 | Event ID 399 | Operational |
| 400 | Event ID 400 | Operational |
| 401 | Event ID 401 | Operational |
| 402 | Event ID 402 | Operational |
| 403 | Event ID 403 | Operational |
| 404 | Event ID 404 | Operational |
| 405 | Event ID 405 | Operational |
| 406 | Event ID 406 | Operational |
| 407 | Event ID 407 | Operational |
| 408 | Event ID 408 | Operational |
| 409 | Event ID 409 | Operational |
| 410 | Event ID 410 | Operational |
| 411 | Event ID 411 | Operational |
| 412 | Event ID 412 | Operational |
| 413 | Event ID 413 | Operational |
| 414 | Event ID 414 | Operational |
| 415 | Event ID 415 | Operational |
| 416 | Event ID 416 | Operational |
| 417 | Event ID 417 | Operational |
| 418 | Event ID 418 | Operational |
| 419 | Event ID 419 | Operational |
| 420 | Event ID 420 | Operational |
| 421 | Event ID 421 | Operational |
| 422 | Event ID 422 | Operational |
| 423 | Event ID 423 | Operational |
| 424 | Event ID 424 | Operational |
| 425 | Event ID 425 | Operational |
| 426 | Event ID 426 | Operational |
| 427 | Event ID 427 | Operational |
| 428 | Event ID 428 | Operational |
| 429 | Event ID 429 | Operational |
| 430 | Event ID 430 | Operational |
| 431 | Event ID 431 | Operational |
| 432 | Event ID 432 | Operational |
| 433 | Event ID 433 | Operational |
| 434 | Event ID 434 | Operational |
| 435 | Event ID 435 | Operational |
| 436 | Event ID 436 | Operational |
| 437 | Event ID 437 | Operational |
| 438 | Event ID 438 | Operational |
| 439 | Event ID 439 | Operational |
| 440 | Event ID 440 | Operational |
| 441 | Event ID 441 | Operational |
| 442 | Event ID 442 | Operational |
| 443 | Event ID 443 | Operational |
| 444 | Event ID 444 | Operational |
| 445 | Event ID 445 | Operational |
| 446 | Event ID 446 | Operational |
| 447 | Event ID 447 | Operational |
| 448 | Event ID 448 | Operational |
| 449 | Event ID 449 | Operational |
| 450 | Event ID 450 | Operational |
| 451 | Event ID 451 | Operational |
| 452 | Event ID 452 | Operational |
| 453 | Event ID 453 | Operational |
| 454 | Event ID 454 | Operational |
| 455 | Event ID 455 | Operational |
| 456 | Event ID 456 | Operational |
| 457 | Event ID 457 | Operational |
| 458 | Event ID 458 | Operational |
| 459 | Event ID 459 | Operational |
| 460 | Event ID 460 | Operational |
| 461 | Event ID 461 | Operational |
| 462 | Event ID 462 | Operational |
| 463 | Event ID 463 | Operational |
| 464 | Event ID 464 | Operational |
| 465 | Event ID 465 | Operational |
| 466 | Event ID 466 | Operational |
| 467 | Event ID 467 | Operational |
| 468 | Event ID 468 | Operational |
| 469 | Event ID 469 | Operational |
| 470 | Event ID 470 | Operational |
| 471 | Event ID 471 | Operational |
| 472 | Event ID 472 | Operational |
| 473 | Event ID 473 | Operational |
| 474 | Event ID 474 | Operational |
| 475 | Event ID 475 | Operational |
| 476 | Event ID 476 | Operational |
| 477 | Event ID 477 | Operational |
| 478 | Event ID 478 | Operational |
| 479 | Event ID 479 | Operational |
| 480 | Event ID 480 | Operational |
| 481 | Event ID 481 | Operational |
| 482 | Event ID 482 | Operational |
| 483 | Event ID 483 | Operational |
| 484 | Event ID 484 | Operational |
| 485 | Event ID 485 | Operational |
| 486 | Event ID 486 | Operational |
| 487 | Event ID 487 | Operational |
| 488 | Event ID 488 | Operational |
| 489 | Event ID 489 | Operational |
| 490 | Event ID 490 | Operational |
| 491 | Event ID 491 | Operational |
| 492 | Event ID 492 | Operational |
| 493 | Event ID 493 | Operational |
| 494 | Event ID 494 | Operational |
| 495 | Event ID 495 | Operational |
| 496 | Event ID 496 | Operational |
| 497 | Event ID 497 | Operational |
| 498 | Event ID 498 | Operational |
| 499 | Event ID 499 | Operational |
| 500 | Event ID 500 | Operational |
| 501 | Event ID 501 | Operational |
| 502 | Event ID 502 | Operational |
| 503 | Event ID 503 | Operational |
| 504 | Event ID 504 | Operational |
| 505 | Event ID 505 | Operational |
| 506 | Event ID 506 | Operational |
| 507 | Event ID 507 | Operational |
| 508 | Event ID 508 | Operational |
| 509 | Event ID 509 | Operational |
| 510 | Event ID 510 | Operational |
| 511 | Event ID 511 | Operational |
| 512 | Event ID 512 | Operational |
| 513 | Event ID 513 | Operational |
| 514 | Event ID 514 | Operational |
| 515 | Event ID 515 | Operational |
| 516 | Event ID 516 | Operational |
| 517 | Event ID 517 | Operational |
| 518 | Event ID 518 | Operational |
| 519 | Event ID 519 | Operational |
| 520 | Event ID 520 | Operational |
| 521 | Event ID 521 | Operational |
| 522 | Event ID 522 | Operational |
| 523 | Event ID 523 | Operational |
| 524 | Event ID 524 | Operational |
| 525 | Event ID 525 | Operational |
| 526 | Event ID 526 | Operational |
| 527 | Event ID 527 | Operational |
| 528 | Event ID 528 | Operational |
| 529 | Event ID 529 | Operational |
| 530 | Event ID 530 | Operational |
| 531 | Event ID 531 | Operational |
| 532 | Event ID 532 | Operational |
| 533 | Event ID 533 | Operational |
| 534 | Event ID 534 | Operational |
| 535 | Event ID 535 | Operational |
| 536 | Event ID 536 | Operational |
| 537 | Event ID 537 | Operational |
| 538 | Event ID 538 | Operational |
| 539 | Event ID 539 | Operational |
| 540 | Event ID 540 | Operational |
| 541 | Event ID 541 | Operational |
| 542 | Event ID 542 | Operational |
| 543 | Event ID 543 | Operational |
| 544 | Event ID 544 | Operational |
| 545 | Event ID 545 | Operational |
| 546 | Event ID 546 | Operational |
| 547 | Event ID 547 | Operational |
| 548 | Event ID 548 | Operational |
| 549 | Event ID 549 | Operational |
| 550 | Event ID 550 | Operational |
| 551 | Event ID 551 | Operational |
| 552 | Event ID 552 | Operational |
| 553 | Event ID 553 | Operational |
| 554 | Event ID 554 | Operational |
| 555 | Event ID 555 | Operational |
| 556 | Event ID 556 | Operational |
| 557 | Event ID 557 | Operational |
| 558 | Event ID 558 | Operational |
| 559 | Event ID 559 | Operational |
| 560 | Event ID 560 | Operational |
| 561 | Event ID 561 | Operational |
| 562 | Event ID 562 | Operational |
| 563 | Event ID 563 | Operational |
| 564 | Event ID 564 | Operational |
| 565 | Event ID 565 | Operational |
| 566 | Event ID 566 | Operational |
| 567 | Event ID 567 | Operational |
| 568 | Event ID 568 | Operational |
| 569 | Event ID 569 | Operational |
| 570 | Event ID 570 | Operational |
| 571 | Event ID 571 | Operational |
| 572 | Event ID 572 | Operational |
| 573 | Event ID 573 | Operational |
| 574 | Event ID 574 | Operational |
| 575 | Event ID 575 | Operational |
| 576 | Event ID 576 | Operational |
| 577 | Event ID 577 | Operational |
| 578 | Event ID 578 | Operational |
| 579 | Event ID 579 | Operational |
| 580 | Event ID 580 | Operational |
| 581 | Event ID 581 | Operational |
| 582 | Event ID 582 | Operational |
| 583 | Event ID 583 | Operational |
| 584 | Event ID 584 | Operational |
| 585 | Event ID 585 | Operational |
| 586 | Event ID 586 | Operational |
| 587 | Event ID 587 | Operational |
| 588 | Event ID 588 | Operational |
| 589 | Event ID 589 | Operational |
| 590 | Event ID 590 | Operational |
| 591 | Event ID 591 | Operational |
| 592 | Event ID 592 | Operational |
| 593 | Event ID 593 | Operational |
| 594 | Event ID 594 | Operational |
| 595 | Event ID 595 | Operational |
| 596 | Event ID 596 | Operational |
| 597 | Event ID 597 | Operational |
| 598 | Event ID 598 | Operational |
| 599 | Event ID 599 | Operational |
| 600 | Event ID 600 | Operational |
| 601 | Event ID 601 | Operational |
| 602 | Event ID 602 | Operational |
| 603 | Event ID 603 | Operational |
| 604 | Event ID 604 | Operational |
| 605 | Event ID 605 | Operational |
| 606 | Event ID 606 | Operational |
| 607 | Event ID 607 | Operational |
| 608 | Event ID 608 | Operational |
| 609 | Event ID 609 | Operational |
| 610 | Event ID 610 | Operational |
| 611 | Event ID 611 | Operational |
| 612 | Event ID 612 | Operational |
| 613 | Event ID 613 | Operational |
| 614 | Event ID 614 | Operational |
| 615 | Event ID 615 | Operational |
| 616 | Event ID 616 | Operational |
| 617 | Event ID 617 | Operational |
| 618 | Event ID 618 | Operational |
| 619 | Event ID 619 | Operational |
| 620 | Event ID 620 | Operational |
| 621 | Event ID 621 | Operational |
| 622 | Event ID 622 | Operational |
| 623 | Event ID 623 | Operational |
| 624 | Event ID 624 | Operational |
| 625 | Event ID 625 | Operational |
| 626 | Event ID 626 | Operational |
| 627 | Event ID 627 | Operational |
| 628 | Event ID 628 | Operational |
| 629 | Event ID 629 | Operational |
| 630 | Event ID 630 | Operational |
| 631 | Event ID 631 | Operational |
| 632 | Event ID 632 | Operational |
| 633 | Event ID 633 | Operational |
| 634 | Event ID 634 | Operational |
| 635 | Event ID 635 | Operational |
| 636 | Event ID 636 | Operational |
| 637 | Event ID 637 | Operational |
| 638 | Event ID 638 | Operational |
| 639 | Event ID 639 | Operational |
| 640 | Event ID 640 | Operational |
| 641 | Event ID 641 | Operational |
| 642 | Event ID 642 | Operational |
| 643 | Event ID 643 | Operational |
| 644 | Event ID 644 | Operational |
| 645 | Event ID 645 | Operational |
| 646 | Event ID 646 | Operational |
| 647 | Event ID 647 | Operational |
| 648 | Event ID 648 | Operational |
| 649 | Event ID 649 | Operational |
| 650 | Event ID 650 | Operational |
| 651 | Event ID 651 | Operational |
| 652 | Event ID 652 | Operational |
| 653 | Event ID 653 | Operational |
| 654 | Event ID 654 | Operational |
| 655 | Event ID 655 | Operational |
| 656 | Event ID 656 | Operational |
| 657 | Event ID 657 | Operational |
| 658 | Event ID 658 | Operational |
| 659 | Event ID 659 | Operational |
| 660 | Event ID 660 | Operational |
| 661 | Event ID 661 | Operational |
| 662 | Event ID 662 | Operational |
| 663 | Event ID 663 | Operational |
| 664 | Event ID 664 | Operational |
| 665 | Event ID 665 | Operational |
| 666 | Event ID 666 | Operational |
| 667 | Event ID 667 | Operational |
| 668 | Event ID 668 | Operational |
| 669 | Event ID 669 | Operational |
| 670 | Event ID 670 | Operational |
| 671 | Event ID 671 | Operational |
| 672 | Event ID 672 | Operational |
| 673 | Event ID 673 | Operational |
| 674 | Event ID 674 | Operational |
| 675 | Event ID 675 | Operational |
| 676 | Event ID 676 | Operational |
| 677 | Event ID 677 | Operational |
| 678 | Event ID 678 | Operational |
| 679 | Event ID 679 | Operational |
| 680 | Event ID 680 | Operational |
| 681 | Event ID 681 | Operational |
| 682 | Event ID 682 | Operational |
| 683 | Event ID 683 | Operational |
| 684 | Event ID 684 | Operational |
| 685 | Event ID 685 | Operational |
| 686 | Event ID 686 | Operational |
| 687 | Event ID 687 | Operational |
| 688 | Event ID 688 | Operational |
| 689 | Event ID 689 | Operational |
| 690 | Event ID 690 | Operational |
| 691 | Event ID 691 | Operational |
| 692 | Event ID 692 | Operational |
| 693 | Event ID 693 | Operational |
| 694 | Event ID 694 | Operational |
| 695 | Event ID 695 | Operational |
| 696 | Event ID 696 | Operational |
| 697 | Event ID 697 | Operational |
| 698 | Event ID 698 | Operational |
| 699 | Event ID 699 | Operational |
| 700 | Event ID 700 | Operational |
| 701 | Event ID 701 | Operational |
| 702 | Event ID 702 | Operational |
| 703 | Event ID 703 | Operational |
| 704 | Event ID 704 | Operational |
| 705 | Event ID 705 | Operational |
| 706 | Event ID 706 | Operational |
| 707 | Event ID 707 | Operational |
| 708 | Event ID 708 | Operational |
| 709 | Event ID 709 | Operational |
| 710 | Event ID 710 | Operational |
| 711 | Event ID 711 | Operational |
| 712 | Event ID 712 | Operational |
| 713 | Event ID 713 | Operational |
| 714 | Event ID 714 | Operational |
| 715 | Event ID 715 | Operational |
| 716 | Event ID 716 | Operational |
| 717 | Event ID 717 | Operational |
Event ID 10:
#Fields #
| Name | Description |
|---|---|
A10_Vcn HexInt64 | |
A11_AttributeFormNonresidentLowestVcn HexInt64 | |
A12_AttributeFormNonresidentHighestVcn HexInt64 | |
A13_AllocationClusters HexInt64 |
Event ID 12:
#Fields #
| Name | Description |
|---|---|
A10_FileObject Pointer | |
A11_Scb Pointer | |
A12_StartingVcn HexInt64 | |
A13_ClusterCount HexInt64 | |
A14_Flags HexInt32 | |
A15_CcbForWriteExtend Pointer |
Event ID 13:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_FileObject Pointer | |
A12_Scb Pointer | |
A13_StartingVcn HexInt64 | |
A14_ClusterCount HexInt64 | |
A15_Flags HexInt32 | |
A16_CcbForWriteExtend Pointer |
Event ID 15:
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_PurgeOffset HexInt64 | |
A12_PurgeChunkLength HexInt32 |
Event ID 16:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_LastVcn HexInt64 | |
A12_AttributeInstance HexInt32 |
Event ID 19:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_ValueLength HexInt32 | |
A12_AttributeFlags HexInt32 |
Event ID 20:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_LastVcn HexInt64 | |
A15_NewHighestVcn HexInt64 | |
A16_PassCount HexInt32 |
Event ID 21:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_ContextFoundAttributeAttributeFormNonresidentLowestVcn HexInt64 | |
A15_ContextFoundAttributeAttributeFormNonresidentHighestVcn HexInt64 | |
A16_ContextAttributeListEntryLowestVcn HexInt64 |
Event ID 22:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_ContextFoundAttributeAttributeFormNonresidentLowestVcn HexInt64 | |
A15_ContextFoundAttributeAttributeFormNonresidentHighestVcn HexInt64 | |
A16_ContextAttributeListEntryLowestVcn HexInt64 |
Event ID 23:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_ContextFoundAttributeAttributeFormNonresidentLowestVcn HexInt64 | |
A15_ContextFoundAttributeAttributeFormNonresidentHighestVcn HexInt64 | |
A16_ContextAttributeListEntryLowestVcn HexInt64 | |
A17_PassCount HexInt32 |
Event ID 24:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_ContextFoundAttributeAttributeFormNonresidentLowestVcn HexInt64 | |
A15_ContextFoundAttributeAttributeFormNonresidentHighestVcn HexInt64 | |
A16_ContextAttributeListEntryLowestVcn HexInt64 |
Event ID 25:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_NtfsFrsConsolidationStatisticsMergeSkipCount HexInt32 |
Event ID 26:
#Fields #
| Name | Description |
|---|---|
A10_FileRecordSegmentNumberHighPart HexInt32 | |
A11_FileRecordSegmentNumberLowPart HexInt32 | |
A12_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 | |
A13_AttributeTypeCode HexInt32 |
Event ID 27:
#Fields #
| Name | Description |
|---|---|
A10_FileRecordSegmentNumberHighPart HexInt32 | |
A11_FileRecordSegmentNumberLowPart HexInt32 | |
A12_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 | |
A13_AttributeTypeCode HexInt32 |
Event ID 28:
#Fields #
| Name | Description |
|---|---|
A10_FcbVcb Pointer | |
A11_IrpContext Pointer | |
A12_PULONGLONG_FcbFileReference HexInt64 | |
A13_StdInfoAttrListEntrySignature HexInt32 | |
A14_StdInfoAttrListEntryLastCompactedSize HexInt32 | |
A15_CurrentAttributeListSize HexInt32 |
Event ID 29:
#Fields #
| Name | Description |
|---|---|
A10_FcbVcb Pointer | |
A11_IrpContext Pointer | |
A12_PULONGLONG_FcbFileReference HexInt64 | |
A13_StdInfoAttrListEntrySignature HexInt32 | |
A14_StdInfoAttrListEntryLastCompactedSize HexInt32 | |
A15_NewStdInfoAttrListEntryLastCompactedSize HexInt32 |
Event ID 30:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_i HexInt32 | |
A12_MAX_MOVEABLE_ATTRIBUTES HexInt32 | |
A13_AttributeTypeCode HexInt32 | |
A14_AttributeRecordLength HexInt32 | |
A15_AttributeInstance HexInt32 |
Event ID 31:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_SizeNeeded HexInt32 | |
A12_AttributeTypeCode HexInt32 | |
A13_AttributeRecordLength HexInt32 | |
A14_AttributeFormCode HexInt32 | |
A15_AttributeInstance HexInt32 |
Event ID 32:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_SizeNeeded HexInt32 | |
A12_BytesToFree HexInt32 | |
A13_MappingPairSize HexInt32 | |
A14_NewMappingPairSize HexInt32 |
Event ID 33:
#Fields #
| Name | Description |
|---|---|
A10_FileRecordSegmentNumberHighPart HexInt32 | |
A11_FileRecordSegmentNumberLowPart HexInt32 | |
A12_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 | |
A13_StartZero HexInt32 | |
A14_ZeroLength HexInt32 |
Event ID 34:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_ScbAttributeTypeCode HexInt32 | |
A15__ScbAttributeName CountedUtf16String | |
A16_NewStartVcn HexInt64 | |
A17_NewHalfWayVcn HexInt64 | |
A18_NewFinalVcn HexInt64 | |
A19_PackedMode HexInt32 | |
A20_TryPrior HexInt32 |
Event ID 35:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_ScbAttributeTypeCode HexInt32 | |
A15__ScbAttributeName CountedUtf16String | |
A16_FileRecordSequenceNumber HexInt32 | |
A17_FileRecordSegmentNumberLowPart HexInt32 | |
A18_NewStartVcn HexInt64 | |
A19_LastVcn HexInt64 | |
A20_NewFinalVcn HexInt64 |
Event ID 36:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_ScbAttributeTypeCode HexInt32 | |
A15__ScbAttributeName CountedUtf16String | |
A16_FileRecordSequenceNumber HexInt32 | |
A17_FileRecordSegmentNumberLowPart HexInt32 | |
A18_NewStartVcn HexInt64 | |
A19_LastVcn HexInt64 | |
A20_NewFinalVcn HexInt64 |
Event ID 37:
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_NewFinalVcn HexInt64 |
Event ID 38:
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_NewHalfWayVcn HexInt64 | |
A15_RangePtr Pointer |
Event ID 39:
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_NewHalfWayVcn HexInt64 | |
A15_RangePtr Pointer |
Event ID 40:
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_NtfsMcbArray Pointer | |
A15_NtfsMcbArrayStartingVcn HexInt64 | |
A16_NtfsMcbArrayEndingVcn HexInt64 |
Event ID 41:
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_NtfsMcbArray Pointer | |
A15_NtfsMcbArrayStartingVcn HexInt64 | |
A16_NtfsMcbArrayEndingVcn HexInt64 |
Event ID 42:
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_NtfsMcbArray Pointer | |
A15_NtfsMcbArrayStartingVcn HexInt64 | |
A16_NtfsMcbArrayEndingVcn HexInt64 |
Event ID 43:
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_NtfsMcbArray Pointer | |
A15_NtfsMcbArrayStartingVcn HexInt64 | |
A16_NtfsMcbArrayEndingVcn HexInt64 |
Event ID 44:
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_NewFinalVcnInMcb HexInt64 | |
A15_NewFinalVcn HexInt64 |
Event ID 45:
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_NewStartVcn HexInt64 | |
A15_LastVcn HexInt64 | |
A16_NewFinalVcn HexInt64 | |
A17_NewFinalVcnInMcb HexInt64 | |
A18_NumberOfRanges HexInt32 | |
A19_DeletedNextAttribute HexInt32 | |
A20_Mcb1StartWithNewStartVcn HexInt32 | |
A21_Mcb1HoldNewStartVcn HexInt32 | |
A22_Mcb2StartWithNewStartVcn HexInt32 | |
A23_Mcb2HoldNewStartVcn HexInt32 | |
A24_McbArraySizeInUseChange Int32 |
Event ID 46:
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_NewStartVcn HexInt64 | |
A15_DeletedNextAttributeNewFinalVcnInMcbLastVcn1 HexInt64 |
Event ID 47:
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_LastVcn HexInt64 | |
A15_NewFinalVcnInMcb HexInt64 |
Event ID 48:
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_ScbAttributeTypeCode HexInt32 | |
A15__ScbAttributeName CountedUtf16String | |
A16_PULONGLONG_ContextAttributeListEntrySegmentReference HexInt64 | |
A17_OldLowestVcn HexInt64 | |
A18_StartVcn HexInt64 | |
A19_NewAttributeInstance HexInt32 |
Event ID 49:
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | |
A14_ScbAttributeTypeCode HexInt32 | |
A15__ScbAttributeName CountedUtf16String | |
A16_OldLowestVcn HexInt64 | |
A17_StartVcn HexInt64 | |
A18_OldHighestVcn HexInt64 | |
A19_LastVcn HexInt64 | |
A20_FileRecordSequenceNumber HexInt32 | |
A21_FileRecordSegmentNumberLowPart HexInt32 |
Event ID 51:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14__VolumeId CountedUtf16String | |
A15_VcbVcbState HexInt32 |
Event ID 52:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_PULONGLONG_FcbFileReference HexInt64 | |
A14_AllFlagsFirstRequest HexInt32 |
Event ID 53:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_PULONGLONG_FcbFileReference HexInt64 |
Event ID 54:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_PULONGLONG_FcbFileReference HexInt64 |
Event ID 55:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_PULONGLONG_FcbFileReference HexInt64 | |
A14_FrsConsolidationContextRestartAttributeTypeCode HexInt32 | |
A15__FrsConsolidationContextRestartAttributeName CountedUtf16String | |
A16_FrsConsolidationContextRestartVcn HexInt64 | |
A17_FrsConsolidationContextRestartAttributeListEntryOffset HexInt32 | |
A18_AttributeListEntryOffset HexInt32 | |
A19_AttrContextAttributeListAttributeListFormNonresidentValidDataLength HexInt64 | |
A20_AttributeListGrowBy HexInt32 | |
A21_AttributeListGrowBy Int32 |
Event ID 56:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_PULONGLONG_FcbFileReference HexInt64 | |
A14_FrsConsolidationContextRestartAttributeTypeCode HexInt32 | |
A15__FrsConsolidationContextRestartAttributeName CountedUtf16String | |
A16_FrsConsolidationContextRestartVcn HexInt64 | |
A17_FrsConsolidationContextInstance HexInt32 | |
A18_FrsConsolidationContextRestartAttributeListEntryOffset HexInt32 | |
A19_AttrContextAttributeListAttributeListFormNonresidentValidDataLength HexInt64 |
Event ID 57:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_PULONGLONG_FcbFileReference HexInt64 | |
A14_FrsConsolidationContextRestartAttributeTypeCode HexInt32 | |
A15__FrsConsolidationContextRestartAttributeName CountedUtf16String | |
A16_FrsConsolidationContextRestartVcn HexInt64 | |
A17_FrsConsolidationContextInstance HexInt32 | |
A18_FrsConsolidationContextRestartAttributeListEntryOffset HexInt32 | |
A19_AttrContextAttributeListAttributeListFormNonresidentValidDataLength HexInt64 |
Event ID 58:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_PULONGLONG_FcbFileReference HexInt64 | |
A14_Scb Pointer |
Event ID 59:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_PULONGLONG_FcbFileReference HexInt64 |
Event ID 60:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_PULONGLONG_FrsConsolidationContextFileReference HexInt64 | |
A13_IrpContextExceptionStatus HexInt32 |
Event ID 61:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_PULONGLONG_FcbFileReference HexInt64 |
Event ID 62:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_PULONGLONG_FcbFileReference HexInt64 |
Event ID 63:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_FileRef HexInt64 | |
A14_ExceptionStatus HexInt32 |
Event ID 64:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_FileRef HexInt64 | |
A14_RemovedFcb HexInt32 | |
A15_AllFlagsFcbAcquired HexInt32 | |
A16_IrpContextTransactionId HexInt32 |
Event ID 65:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_EndTimeQuadPart1000NtfsPerformanceFrequencyQuadPart Int64 | |
A13_FrsConsolidationContextTotalTime1000NtfsPerformanceFrequencyQuadPart Int64 |
Event ID 66:
#Fields #
| Name | Description |
|---|---|
A10_FcbVcb Pointer | |
A11_IrpContext Pointer | |
A12_PULONGLONG_FcbFileReference HexInt64 | |
A13_StdInfoAttrListEntrySignature HexInt32 | |
A14_StdInfoAttrListEntryLastCompactedSize HexInt32 | |
A15_AttributeListSize HexInt32 |
Event ID 67:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12_Scb Pointer | |
A13__ScbMcb Pointer | |
A14_OriginalStartingVcn HexInt64 | |
A15_ClusterCount HexInt64 | |
A16_AllocateAll UInt32 | |
A17_TargetLcnNULLTargetLcnULONGLONG1 HexInt64 | |
A18_PreAllocated UInt32 | |
A19_UseDelayedAllocation UInt32 |
Event ID 68:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12_Scb Pointer | |
A13__ScbMcb Pointer | |
A14_OriginalStartingVcn HexInt64 | |
A15_ClusterCount HexInt64 | |
A16_AllocateAll UInt32 | |
A17_TargetLcnNULLTargetLcnULONGLONG1 HexInt64 | |
A18_PreAllocated UInt32 | |
A19_UseDelayedAllocation UInt32 |
Event ID 69:
#Fields #
| Name | Description |
|---|---|
A10_FoundClusterCount HexInt64 | |
A11_Scb Pointer | |
A12_ScbTotalAllocated HexInt64 |
Event ID 70:
#Fields #
| Name | Description |
|---|---|
A10_FoundClusterCount HexInt64 | |
A11_Scb Pointer | |
A12_ScbTotalAllocated HexInt64 | |
A13_ScbState HexInt32 | |
A14_IrpContextState2 HexInt32 | |
A15_AllocateWithNoHole Int32 |
Event ID 73:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12_Scb Pointer | |
A13__ScbMcb Pointer | |
A14_StartingVcn HexInt64 | |
A15_EndingVcn HexInt64 |
Event ID 74:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_PULONGLONG_ScbFcbFileReference HexInt64 | |
A12_StartingVcn HexInt64 | |
A13_EndingVcn HexInt64 |
Event ID 75:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12_Scb Pointer | |
A13__ScbMcb Pointer | |
A14_StartingVcn HexInt64 | |
A15_EndingVcn HexInt64 |
Event ID 76:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_PULONGLONG_ScbFcbFileReference HexInt64 | |
A12_AdjLcn HexInt64 | |
A13_AdjClusterCount HexInt64 |
Event ID 78:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_DeallocatedClusters Pointer | |
A12_DeallocatedClustersLsnQuadPart HexInt64 | |
A13_DeallocatedClustersClusterCount HexInt64 | |
A14_DeallocatedClustersFlags HexInt32 | |
A15_VcbDeallocatedClusters HexInt64 | |
A16_VcbDeallocatedClustersAdjClusterCount HexInt64 |
Event ID 79:
#Fields #
| Name | Description |
|---|---|
A10_ClusterCount HexInt64 | |
A11_Scb Pointer | |
A12_TotalAllocated HexInt64 | |
A13_TotalAllocated Pointer |
Event ID 80:
#Fields #
| Name | Description |
|---|---|
A10_ClusterCount HexInt64 | |
A11_Scb Pointer | |
A12_TotalAllocated Pointer | |
A13_ScbState HexInt32 | |
A14_IrpContextState2 HexInt32 |
Event ID 81:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_VcbDeallocatedClusters HexInt64 | |
A12_VcbDeallocatedClustersClustersRemoved HexInt64 |
Event ID 84:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12_FirstBit HexInt64 | |
A13_BeyondFinalBit HexInt64 | |
A14_RedoOperation HexInt32 | |
A15_UndoOperation HexInt32 |
Event ID 85:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11__Bitmap Pointer | |
A12_BaseLcn HexInt64 | |
A13_CurrentLcn HexInt64 |
Event ID 86:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12_StartingLcn HexInt64 | |
A13_ClusterCount HexInt64 |
Event ID 87:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11__Bitmap Pointer | |
A12_BaseLcn HexInt64 | |
A13_StartingLcn HexInt64 |
Event ID 88:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Bitmap Pointer | |
A12_BitMapOffset HexInt32 | |
A13_NumberOfBits HexInt32 |
Event ID 89:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12_StartingLcn HexInt64 | |
A13_ClusterCount HexInt64 |
Event ID 90:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11__Bitmap Pointer | |
A12_BaseLcn HexInt64 | |
A13_StartingLcn HexInt64 |
Event ID 91:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Bitmap Pointer | |
A12_BitMapOffset HexInt32 | |
A13_NumberOfBits HexInt32 |
Event ID 92:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12_Bitmap Pointer | |
A13_StartingBitmapLcn HexInt64 | |
A14_SetBits UInt32 |
Event ID 93:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Bitmap Pointer | |
A12_StartingBit HexInt64 | |
A13_EndingBit HexInt64 |
Event ID 95:
#Fields #
| Name | Description |
|---|---|
A10_i HexInt32 | |
A11_OriginalSystemBitmapisizeofOriginalSystemBitmap0 HexInt32 |
Event ID 96:
#Event ID 97:
#Fields #
| Name | Description |
|---|---|
A10_Length Int64 | |
A11_BinIndex UInt32 | |
A12_Key UInt32 | |
A13_BitPosition Int32 | |
A14_GroupIndex Int32 | |
A15_GroupShiftFactor Int32 |
Event ID 100:
#Fields #
| Name | Description |
|---|---|
A10_BinIndex UInt32 | |
A11_MaxLength Int64 | |
A12_GroupIndex Int32 | |
A13_RelativeBinIndex Int32 | |
A14_MaxKey UInt32 |
Event ID 101:
#Fields #
| Name | Description |
|---|---|
A10_NtfsCachedRunBinGroupShift Int32 | |
A11_NtfsCachedRunBinGroupSize UInt32 | |
A12_NtfsCachedRunBinGroupMask HexInt32 |
Event ID 103:
#Fields #
| Name | Description |
|---|---|
A10_StartingCluster HexInt64 | |
A11_ClusterCount HexInt64 | |
A12_VcbTotalClustersCommitted HexInt64 | |
A13_VcbTotalClusters HexInt64 | |
A14_VcbFreeClusters HexInt64 |
Event ID 104:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_FirstBitToClear HexInt32 | |
A12_BeyondLastBitToClear1 HexInt32 |
Event ID 106:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_FreeClusterBase1 HexInt64 | |
A12_FreeClusterCount1 HexInt64 |
Event ID 108:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_FreeClusterBase2 HexInt64 | |
A12_FreeClusterCount2 HexInt64 |
Event ID 109:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_PsGetCurrentThread Pointer | |
A12_VcbTotalClustersCommitted HexInt64 | |
A13_VcbTotalClusters HexInt64 | |
A14_VcbTPMapSizeOfBitMap HexInt32 |
Event ID 111:
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_StartingZero HexInt64 | |
A12_ByteCount HexInt64 | |
A13_ExtentsDescriptor Pointer | |
A14_ExtentsDescriptorIndex Int32 | |
A15_ExtentsDescriptorStartOffset HexInt64 | |
A16_Offset HexInt64 | |
A17_MaxRuns Int32 |
Event ID 112:
#Fields #
| Name | Description |
|---|---|
A10_RunIndex Int32 | |
A11_ExtentsDescriptorRunRunIndexBasePage HexInt64 | |
A12_ExtentsDescriptorRunRunIndexPageCount HexInt64 | |
A13_ExtentLength HexInt64 | |
A14_Offset HexInt64 | |
A15_RunIndexStartOffset HexInt64 |
Event ID 113:
#Event ID 115:
#Fields #
| Name | Description |
|---|---|
A10_StartingPhysicalAddrQuadPart HexInt64 | |
A11_LengthInExtent HexInt64 |
Event ID 116:
#Fields #
| Name | Description |
|---|---|
A10_ExtentsDescriptorIndex Int32 | |
A11_ExtentsDescriptorStartOffset HexInt64 |
Event ID 117:
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_StartingOffset HexInt64 | |
A12_BeyondEndOffset HexInt64 |
Event ID 118:
#Fields #
| Name | Description |
|---|---|
A10_DataSetRangeIndex Int32 | |
A11_DsmBufferDataSetRangesDataSetRangeIndexStartingOffset HexInt64 | |
A12_DsmBufferDataSetRangesDataSetRangeIndexLengthInBytes HexInt64 |
Event ID 120:
#Fields #
| Name | Description |
|---|---|
A10_DsmByteAddressRangesTotalNumberOfRanges Int32 | |
A11_DsmByteAddressRangesNumberOfRangesReturned Int32 |
Event ID 121:
#Fields #
| Name | Description |
|---|---|
A10_Index Int32 | |
A11_DsmByteAddressRangesRangesIndexStartAddress HexInt64 | |
A12_DsmByteAddressRangesRangesIndexLengthInBytes HexInt64 |
Event ID 122:
#Fields #
| Name | Description |
|---|---|
A10_StartingPhysicalAddrQuadPart HexInt64 | |
A11_LengthInExtent HexInt64 |
Event ID 123:
#Fields #
| Name | Description |
|---|---|
A10_ExtentsDescriptorIndex Int32 | |
A11_ExtentsDescriptorStartOffset HexInt64 |
Event ID 124:
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_StartingZero HexInt64 | |
A12_BeyondEndOffset HexInt64 | |
A13_ByteCount HexInt64 | |
A14_ExtentsDescriptor Pointer | |
A15_ExtentsDescriptorIndexExtentsDescriptorIndex0 Int32 | |
A16_ExtentsDescriptorStartOffsetExtentsDescriptorStartOffset0 HexInt64 |
Event ID 125:
#Fields #
| Name | Description |
|---|---|
A10_ExtentsDescriptorIndex Int32 | |
A11_ExtentsDescriptorStartOffset HexInt64 |
Event ID 126:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Scb Pointer | |
A12_StartOffset HexInt64 | |
A13_ByteCount HexInt32 |
Event ID 132:
#Fields #
| Name | Description |
|---|---|
A10_Irp Pointer | |
A11_IrpContext Pointer | |
A12_Vcb Pointer | |
A13_CreateContextFileObject Pointer | |
A14_CreateContextFileObjectRelatedFileObject Pointer | |
A15__CreateContextFileObjectFileName 25 | |
A16_CreateContextIrpSpParametersCreateOptions HexInt32 | |
A17_CreateContextIrpSpParametersCreateFileAttributes HexInt32 | |
A18_CreateContextDesiredAccess HexInt32 | |
A19_CreateContextIrpSpParametersCreateShareAccess HexInt32 | |
A20_CreateContextIrpSpParametersCreateEaLength HexInt32 |
Event ID 133:
#Fields #
| Name | Description |
|---|---|
A10_Irp Pointer | |
A11_IrpContext Pointer | |
A12_Vcb Pointer | |
A13_CreateContextFileObject Pointer | |
A14_CreateContextFileObjectRelatedFileObject Pointer | |
A15__CreateContextFileObjectFileName CountedUtf16String | |
A16_CreateContextIrpSpParametersCreateOptions HexInt32 | |
A17_CreateContextIrpSpParametersCreateFileAttributes HexInt32 | |
A18_CreateContextDesiredAccess HexInt32 | |
A19_CreateContextIrpSpParametersCreateShareAccess HexInt32 | |
A20_CreateContextIrpSpParametersCreateEaLength HexInt32 |
Event ID 134:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbVcbState HexInt32 |
Event ID 136:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbVcbState HexInt32 |
Event ID 137:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_IrpSpParametersCreateShareAccess HexInt32 | |
A15_ReadULongNoFence_VcbCleanupCount Int32 | |
A16_BiasedCleanupCount Int32 |
Event ID 138:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbVcbState HexInt32 |
Event ID 139:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_IrpSpParametersCreateShareAccess HexInt32 | |
A15_VcbReadOnlyCloseCount Int32 | |
A16_VcbCloseCount Int32 | |
A17_VcbSystemFileCloseCount Int32 |
Event ID 140:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_FcbCleanupCount Int32 | |
A17_FcbFcbState HexInt32 | |
A18_IrpSpFlags HexInt32 |
Event ID 141:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_FcbFcbState HexInt32 | |
A17_IrpSpFlags HexInt32 |
Event ID 142:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_IrpContextState HexInt32 | |
A17_IrpSpFlags HexInt32 |
Event ID 143:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisFcbFcbState HexInt32 | |
A17_CreateContextIrpSpParametersCreateOptions24_0x000000ff HexInt32 | |
A18_CreateContextIrpSpParametersCreateSecurityContextDesiredAccess HexInt32 |
Event ID 144:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_CreateContextCurrentFcbVcb Pointer | |
A12__CreateContextCurrentFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWCreateContextCurrentFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHCreateContextCurrentFcbVcbVpb CountedUtf16String | |
A14_CreateContextCurrentFcb Pointer | |
A15_NtfsFullFileRefNumber_CreateContextCurrentFcbFileReference HexInt64 | |
A16_CreateContextCurrentFcbInfoFileAttributes HexInt32 | |
A17_CreateContextCurrentFcbTxfRmcbRmState HexInt32 |
Event ID 145:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_CreateContextCurrentFcbVcb Pointer | |
A12__CreateContextCurrentFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWCreateContextCurrentFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHCreateContextCurrentFcbVcbVpb CountedUtf16String | |
A14_CreateContextCurrentFcb Pointer | |
A15_NtfsFullFileRefNumber_CreateContextCurrentFcbFileReference HexInt64 | |
A16_CreateContextCurrentFcbFcbState HexInt32 | |
A17_CreateContextIrpSpParametersCreateOptions24_0x000000ff HexInt32 | |
A18_CreateContextIrpSpParametersCreateSecurityContextDesiredAccess HexInt32 |
Event ID 146:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisFcbFcbState HexInt32 |
Event ID 147:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisFcbFcbState HexInt32 | |
A17_CreateContextIrpSpParametersCreateOptions24_0x000000ff HexInt32 | |
A18_CreateContextIrpSpParametersCreateSecurityContextDesiredAccess HexInt32 |
Event ID 148:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisFcbTxfRmcbRmState HexInt32 |
Event ID 149:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ParentScbFcbVcb Pointer | |
A12__ParentScbFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWParentScbFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHParentScbFcbVcbVpb CountedUtf16String | |
A14_ParentScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ParentScbFcbFileReference HexInt64 | |
A16_ParentScbFcbFcbState HexInt32 | |
A17_ParentScbFcbTxfRmcbRmState HexInt32 | |
A18_AttrTypeCode HexInt32 |
Event ID 150:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_CreateContextIrpSpParametersCreateOptions HexInt32 | |
A17_CcbFlags HexInt32 |
Event ID 151:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ParentScbVcb Pointer | |
A12__ParentScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWParentScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHParentScbVcbVpb CountedUtf16String | |
A14_ParentScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ParentScbFcbFileReference HexInt64 | |
A16_ParentScbFcbFcbState HexInt32 | |
A17_ParentScbFcbTxfRmcbRmState HexInt32 |
Event ID 152:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisFcbTxfRmcbRmState HexInt32 |
Event ID 153:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisEaInformationNeedEaCount Int32 | |
A17_CreateContextIrpSpParametersCreateOptions HexInt32 | |
A18_CcbFlags HexInt32 |
Event ID 154:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_AttrTypeCode HexInt32 | |
A17_CreateDisposition HexInt32 |
Event ID 155:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_CreateDisposition HexInt32 |
Event ID 156:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisFcbFcbState HexInt32 | |
A17_AttrTypeCode HexInt32 |
Event ID 157:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisFcbInfoFileAttributes HexInt32 | |
A17_FileAttributes HexInt32 |
Event ID 158:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_CreateContextIrpSpParametersCreateOptions HexInt32 |
Event ID 159:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_CreateContextThisScbAttributeTypeCode HexInt32 | |
A17_CreateContextThisScbState HexInt32 | |
A18_CreateContextThisScbScbTypeDataHighWaterMark Int64 |
Event ID 160:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_AttrCode HexInt32 | |
A15_CreateDisposition HexInt32 |
Event ID 161:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_AttrCode HexInt32 | |
A15_IrpSpParametersCreateSecurityContextAccessStateOriginalDesiredAccess HexInt32 |
Event ID 163:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisScbVcb Pointer | |
A12__ThisScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisScbVcbVpb CountedUtf16String | |
A14_ThisScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisScbFcbFileReference HexInt64 | |
A16_ThisScb Pointer | |
A17_ThisScbAttributeTypeCode HexInt32 | |
A18__ThisScbAttributeName CountedUtf16String | |
A19_IrpSpParametersCreateShareAccess HexInt32 | |
A20_IrpSpParametersCreateSecurityContextAccessStatePreviouslyGrantedAccess HexInt32 |
Event ID 164:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisScbVcb Pointer | |
A12__ThisScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisScbVcbVpb CountedUtf16String | |
A14_ThisScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisScbFcbFileReference HexInt64 | |
A16_ThisScb Pointer | |
A17_ThisScbAttributeTypeCode HexInt32 | |
A18__ThisScbAttributeName CountedUtf16String |
Event ID 165:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisScbVcb Pointer | |
A12__ThisScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisScbVcbVpb CountedUtf16String | |
A14_ThisScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisScbFcbFileReference HexInt64 | |
A16_ThisScb Pointer | |
A17_ThisScbAttributeTypeCode HexInt32 | |
A18__ThisScbAttributeName CountedUtf16String | |
A19_IrpSpParametersCreateSecurityContextAccessStatePreviouslyGrantedAccess HexInt32 |
Event ID 166:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisScbVcb Pointer | |
A12__ThisScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisScbVcbVpb CountedUtf16String | |
A14_ThisScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisScbFcbFileReference HexInt64 | |
A16_ThisScb Pointer | |
A17_ThisScbMarkHandleDisallowWritesCount Int32 | |
A18_IrpSpParametersCreateSecurityContextDesiredAccess HexInt32 |
Event ID 167:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisScbVcb Pointer | |
A12__ThisScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisScbVcbVpb CountedUtf16String | |
A14_ThisScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisScbFcbFileReference HexInt64 | |
A16_ThisScb Pointer | |
A17_ThisScbAttributeTypeCode HexInt32 | |
A18__ThisScbAttributeName CountedUtf16String | |
A19_IrpSpParametersCreateShareAccess HexInt32 | |
A20_GrantedAccess HexInt32 |
Event ID 168:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisScbVcb Pointer | |
A12__ThisScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisScbVcbVpb CountedUtf16String | |
A14_ThisScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisScbFcbFileReference HexInt64 | |
A16_IrpSpParametersCreateShareAccess HexInt32 | |
A17_IrpSpFileObjectFlags HexInt32 |
Event ID 169:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisScbVcb Pointer | |
A12__ThisScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisScbVcbVpb CountedUtf16String | |
A14_ThisScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisScbFcbFileReference HexInt64 | |
A16_ThisScb Pointer | |
A17_ThisScbAttributeTypeCode HexInt32 | |
A18__ThisScbAttributeName CountedUtf16String | |
A19_IrpSpParametersCreateShareAccess HexInt32 | |
A20_GrantedAccess HexInt32 |
Event ID 170:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_IrpSpParametersCreateShareAccess HexInt32 | |
A17_IrpSpFileObjectFlags HexInt32 |
Event ID 171:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_IrpSpParametersCreateSecurityContextDesiredAccess HexInt32 | |
A17_ThisFcbInfoFileAttributes HexInt32 | |
A18_IrpSpFlags HexInt32 |
Event ID 172:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_CurrentFcbVcb Pointer | |
A12__CurrentFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWCurrentFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHCurrentFcbVcbVpb CountedUtf16String | |
A14_CurrentFcb Pointer | |
A15_NtfsFullFileRefNumber_CurrentFcbFileReference HexInt64 | |
A16_CurrentFcbInfoFileAttributes HexInt32 | |
A17_NtfsDataFlags HexInt32 |
Event ID 173:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_CurrentFcbVcb Pointer | |
A12__CurrentFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWCurrentFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHCurrentFcbVcbVpb CountedUtf16String | |
A14_CurrentFcb Pointer | |
A15_NtfsFullFileRefNumber_CurrentFcbFileReference HexInt64 | |
A16_CurrentFcbInfoFileAttributes HexInt32 | |
A17_ThisScbAttributeFlags HexInt32 |
Event ID 174:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisScbVcb Pointer | |
A12__ThisScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisScbVcbVpb CountedUtf16String | |
A14_ThisScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisScbFcbFileReference HexInt64 | |
A16_CreateContextCurrentFcbCleanupCount Int32 | |
A17_NtfsDataEncryptionCallBackTableImplementationFlags HexInt32 |
Event ID 175:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_CurrentFcb Pointer | |
A12_NtfsFullFileRefNumber_CurrentFcbFileReference HexInt64 | |
A13_CurrentFcbTxfRmcbRmState HexInt32 |
Event ID 176:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_LcbFcbVcb Pointer | |
A12__LcbFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWLcbFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHLcbFcbVcbVpb CountedUtf16String | |
A14_LcbFcb Pointer | |
A15_NtfsFullFileRefNumber_LcbFcbFileReference HexInt64 | |
A16_WppCountedStringWLcbFileNameAttrFileNameUSHORTLcbFileNameAttrFileNameLength CountedUtf16String | |
A17_DesiredAccess HexInt32 | |
A18_DesiredShareAccess HexInt32 | |
A19_IoShareAccessFlags HexInt32 | |
A20_LinkShareAccessOpenCount Int32 | |
A21_LinkShareAccessDeleters Int32 | |
A22_LinkShareAccessSharedDelete Int32 |
Event ID 177:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_ScbAttributeTypeCode HexInt32 | |
A17__ScbAttributeName CountedUtf16String | |
A18_DesiredAccess HexInt32 | |
A19_DesiredShareAccess HexInt32 | |
A20_IoShareAccessFlags HexInt32 | |
A21_ShareAccessOpenCount Int32 | |
A22_ShareAccessReaders Int32 | |
A23_ShareAccessWriters Int32 | |
A24_ShareAccessDeleters Int32 | |
A25_ShareAccessSharedRead Int32 | |
A26_ShareAccessSharedWrite Int32 | |
A27_ShareAccessSharedDelete Int32 |
Event ID 178:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_ScbAttributeTypeCode HexInt32 | |
A17__ScbAttributeName CountedUtf16String | |
A18_WppCountedStringWLcbFileNameAttrFileNameUSHORTLcbFileNameAttrFileNameLength CountedUtf16String | |
A19_DesiredAccess HexInt32 | |
A20_DesiredShareAccess HexInt32 | |
A21_IoShareAccessFlags HexInt32 | |
A22_ShareAccessOpenCount Int32 | |
A23_ShareAccessReaders Int32 | |
A24_ShareAccessWriters Int32 | |
A25_ShareAccessDeleters Int32 | |
A26_ShareAccessSharedRead Int32 | |
A27_ShareAccessSharedWrite Int32 | |
A28_ShareAccessSharedDelete Int32 | |
A29_LinkShareAccessOpenCount Int32 | |
A30_LinkShareAccessDeleters Int32 | |
A31_LinkShareAccessSharedDelete Int32 |
Event ID 179:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_ScbAttributeTypeCode HexInt32 | |
A17__ScbAttributeName CountedUtf16String | |
A18_ARGUMENT_PRESENTLcbWppCountedStringWLcbFileNameAttrFileNameUSHORTLcbFileNameAttrFileNameLengthWppCountedStringWNULL0 CountedUtf16String | |
A19_AccessStatePreviouslyGrantedAccess HexInt32 | |
A20_AccessStateFlags HexInt32 | |
A21_DesiredShareAccess HexInt32 | |
A22_CreateDisposition HexInt32 | |
A23_ScbShareAccessOpenCount Int32 | |
A24_ScbShareAccessReaders Int32 | |
A25_ScbShareAccessWriters Int32 | |
A26_ScbShareAccessDeleters Int32 | |
A27_ScbShareAccessSharedRead Int32 | |
A28_ARGUMENT_PRESENTLcbLcbLinkShareAccessDeleters0 Int32 |
Event ID 180:
#Fields #
| Name | Description |
|---|---|
A10_FILEID_FROM_SOURCEFileNLine UInt32 | |
A11_LINENUM_FROM_SOURCEFileNLine Int32 | |
A12_Status HexInt32 | |
A13__ProcessName CountedMbcsString |
Event ID 181:
#Fields #
| Name | Description |
|---|---|
A10_FILEID_FROM_SOURCEFileNLine UInt32 | |
A11_LINENUM_FROM_SOURCEFileNLine Int32 | |
A12_Status HexInt32 | |
A13__ProcessName CountedMbcsString |
Event ID 182:
#Fields #
| Name | Description |
|---|---|
A10_FILEID_FROM_SOURCEFileNLine UInt32 | |
A11_LINENUM_FROM_SOURCEFileNLine Int32 | |
A12_Status HexInt32 | |
A13__ProcessName CountedMbcsString |
Event ID 183:
#Fields #
| Name | Description |
|---|---|
A10_FILEID_FROM_SOURCEFileNLine UInt32 | |
A11_LINENUM_FROM_SOURCEFileNLine Int32 | |
A12_Status HexInt32 | |
A13__ProcessName CountedMbcsString |
Event ID 184:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_StartingCluster HexInt64 | |
A12_RunLength HexInt32 |
Event ID 186:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_MarkUnusedContext Pointer | |
A12_MarkUnusedContextDeallocatedClusters Pointer | |
A13__MarkUnusedContextDeallocatedClustersMcb Pointer |
Event ID 187:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_StartingCluster HexInt64 | |
A12_RunLength HexInt32 | |
A13__MarkUnusedContextDeallocatedClustersMcb Pointer |
Event ID 188:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11__MarkUnusedContextDeallocatedClustersMcb Pointer |
Event ID 189:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_MarkUnusedContext Pointer | |
A12_IrpContext Pointer |
Event ID 191:
#Fields #
| Name | Description |
|---|---|
A10_Src Pointer | |
A11_Dst Pointer | |
A12_SrcClustersCount HexInt64 | |
A13_SrcDeallocatedClustersClusterCount HexInt64 | |
A14_SrcDsmAttrDataSetRangesLength HexInt32 |
Event ID 192:
#Fields #
| Name | Description |
|---|---|
A10_Src Pointer | |
A11_Dst Pointer | |
A12_SrcClustersCount HexInt64 | |
A13_DstClustersCount HexInt64 | |
A14_DstDsmAttrDataSetRangesLength HexInt32 | |
A15_DstFirstDataSetRangePtrLengthInBytes HexInt64 | |
A16_DstFirstDataSetRangePtrStartingOffset HexInt64 |
Event ID 193:
#Event ID 194:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_MarkUnusedContext Pointer | |
A12_VcbDeallocatedClusters HexInt64 | |
A13_VcbDeallocatedClustersListLengthInTrim HexInt32 | |
A14_VcbDeallocatedClustersListLengthToDrain HexInt32 | |
A15_ClustersClusterCount HexInt64 | |
A16_InitialRanges HexInt32 |
Event ID 195:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_MarkUnusedContext Pointer | |
A12_StartingLcn HexInt64 | |
A13_ClusterCount HexInt64 | |
A14_FreeClusterBase1 HexInt64 | |
A15_FreeClusterCount1 HexInt64 | |
A16_FreeClusterBase2 HexInt64 | |
A17_FreeClusterCount2 HexInt64 |
Event ID 198:
#Event ID 204:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_SmallMarkUnusedContext Pointer | |
A12_MarkUnusedContext Pointer |
Event ID 207:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_MarkUnusedContext Pointer | |
A12_TrimEntryCount HexInt32 | |
A13_DataSetRangePtrStartingOffset HexInt64 | |
A14_DataSetRangePtrLengthInBytes HexInt64 |
Event ID 208:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_MarkUnusedContext Pointer | |
A12_IrpUsed Pointer |
Event ID 209:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_MarkUnusedContext Pointer | |
A12_Status HexInt32 |
Event ID 212:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_Status HexInt32 | |
A12_MarkUnusedContext Pointer | |
A13_MarkUnusedContextNULL__MarkUnusedContextDeallocatedClustersNULLMarkUnusedContextDeallocatedClustersClusterCount1LL HexInt64 |
Event ID 213:
#Event ID 222:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_DeallocatedClustersToWaitForDeallocatedClusters Pointer |
Event ID 224:
#Fields #
| Name | Description |
|---|---|
A10_IrpContextVcb Pointer | |
A11_DeallocatedClustersToWaitForDeallocatedClusters Pointer |
Event ID 225:
#Fields #
| Name | Description |
|---|---|
A10_WaitInSeconds Int32 | |
A11_CurrentTimeQuadPartDeallocatedClustersToWaitForEndTimeQuadPartULONGCurrentTimeQuadPartDeallocatedClustersToWaitForEndTimeQuadPartNtfsDataSystemTimeIncrementINTERVAL_ONE_SECOND0 Int32 | |
A12_IrpContext Pointer | |
A13_IrpContextVcb Pointer | |
A14_DeallocatedClusters Pointer |
Event ID 226:
#Fields #
| Name | Description |
|---|---|
A10_WaitInSeconds Int32 | |
A11_CurrentTimeQuadPartDeallocatedClustersToWaitForEndTimeQuadPartULONGCurrentTimeQuadPartDeallocatedClustersToWaitForEndTimeQuadPartNtfsDataSystemTimeIncrementINTERVAL_ONE_SECOND0 Int32 | |
A12_IrpContext Pointer | |
A13_IrpContextVcb Pointer | |
A14_DeallocatedClusters Pointer |
Event ID 227:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_VcbDeallocatedClustersListLengthInTrim Int32 |
Event ID 232:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_MarkUnusedContext Pointer | |
A12_RunIndex UInt32 | |
A13_StartingOffset HexInt64 | |
A14_LengthInBytes HexInt64 |
Event ID 233:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_MarkUnusedContext Pointer | |
A12_DataSetRangeCount UInt32 | |
A13_McbRunCount UInt32 | |
A14_SmartTrimFreeRangeCount UInt32 |
Event ID 234:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_MarkUnusedContext Pointer | |
A12_RunIndex UInt32 | |
A13_DataSetRangeStartingOffset HexInt64 | |
A14_DataSetRangeLengthInBytes HexInt64 |
Event ID 235:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_StartingLcn HexInt64 | |
A12_ClusterCount HexInt64 | |
A13_FirstTpMapBit HexInt32 | |
A14_LastTpMapBit HexInt32 |
Event ID 237:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_SlabRangeIndex UInt32 | |
A12_SlabRangeFirstTPMapBit HexInt32 | |
A13_SlabRangeLastTPMapBit HexInt32 |
Event ID 244:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_TpMapBit HexInt32 | |
A12_SlabBaseLcn HexInt64 | |
A13_SlabLengthInClusters HexInt64 |
Event ID 248:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbVcbState HexInt32 | |
A15_IrpSpFlags HexInt32 |
Event ID 249:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Status HexInt32 |
Event ID 250:
#Event ID 251:
#Event ID 252:
#Event ID 253:
#Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | |
A11_StartingVbo HexInt64 | |
A12_ByteCount HexInt32 |
Event ID 255:
#Fields #
| Name | Description |
|---|---|
A10_ULONGBadVcn HexInt32 | |
A11_PLARGE_INTEGER_BadVcnHighPart HexInt32 |
Event ID 256:
#Fields #
| Name | Description |
|---|---|
A10_ULONGBadLcn HexInt32 | |
A11_PLARGE_INTEGER_BadLcnHighPart HexInt32 |
Event ID 257:
#Event ID 258:
#Event ID 259:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12_NewBufferSize HexInt32 |
Event ID 260:
#Fields #
| Name | Description |
|---|---|
A10_NewBufferSize HexInt32 | |
A11_NtfsGetCompressionBufferSize HexInt32 |
Event ID 262:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12_NewBufferSize HexInt32 |
Event ID 265:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_ScbPersist HexInt32 | |
A20_CcbFlags HexInt32 |
Event ID 268:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_ScbPersist HexInt32 | |
A20_CcbFlags HexInt32 |
Event ID 269:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A14_MoveDataStartingVcnQuadPart HexInt64 | |
A15_TransferClusters HexInt64 | |
A16_Lcn HexInt64 | |
A17_MoveDataStartingLcnQuadPart HexInt64 | |
A18_CopyLength HexInt32 | |
A19_FlagsUseDelayedAllocation Int32 | |
A20_Status HexInt32 |
Event ID 270:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A14_MoveDataStartingVcnQuadPart HexInt64 | |
A15_TransferClusters HexInt64 | |
A16_Lcn HexInt64 | |
A17_MoveDataStartingLcnQuadPart HexInt64 | |
A18_CopyLength HexInt32 | |
A19_FlagsUseDelayedAllocation Int32 | |
A20_MyStatus HexInt32 |
Event ID 271:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A14_Lcn HexInt64 | |
A15_CopyLength HexInt32 | |
A16_MyStatus HexInt32 |
Event ID 272:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A14_MoveDataStartingLcnQuadPart HexInt64 | |
A15_CopyLength HexInt32 | |
A16_MyStatus HexInt32 |
Event ID 273:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A14_MoveDataStartingVcnQuadPart HexInt64 | |
A15_TransferClusters HexInt64 | |
A16_Lcn HexInt64 | |
A17_MoveDataStartingLcnQuadPart HexInt64 | |
A18_FlagsUseDelayedAllocation Int32 | |
A19_ValidClusters HexInt64 |
Event ID 274:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A14_MoveDataStartingVcnQuadPart HexInt64 | |
A15_TransferClusters HexInt64 |
Event ID 275:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_FcbNULLNtfsFullFileRefNumber_FcbFileReference0 HexInt64 | |
A16_CcbNULLCcbFlags0 HexInt32 |
Event ID 276:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18_ScbAttributeNameBuffer UnicodeString | |
A19_ScbPersist HexInt32 | |
A20_CcbFlags HexInt32 |
Event ID 279:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_ScbPersist HexInt32 | |
A20_CcbNULLCcbFlags0 HexInt32 |
Event ID 280:
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_ScbHeaderValidDataLengthQuadPart HexInt64 | |
A12_ScbHeaderFileSizeQuadPart HexInt64 | |
A13_QueryDaxExtentsFileOffset HexInt64 | |
A14_StartingVcn HexInt64 | |
A15_QueryDaxExtentsLength HexInt64 |
Event ID 281:
#Fields #
| Name | Description |
|---|---|
A10_QueryDaxExtentsFileOffset HexInt64 | |
A11_QueryDaxExtentsLength HexInt64 | |
A12_EffectiveInputFileRegionLength HexInt64 | |
A13_StartingVcn HexInt64 | |
A14_BeyondEndVcn HexInt64 | |
A15_RemainingClusterCount HexInt64 | |
A16_LastVcnInFile HexInt64 |
Event ID 282:
#Event ID 283:
#Fields #
| Name | Description |
|---|---|
A10_RemainingClusterCount HexInt64 | |
A11_DataSetRangeIndex Int32 | |
A12_OutputBufferLength Int32 |
Event ID 284:
#Fields #
| Name | Description |
|---|---|
A10_ExtentsDescriptorNumberOfValidRuns HexInt32 | |
A11_MaxRuns HexInt32 | |
A12_BytesReturned HexInt64 |
Event ID 285:
#Fields #
| Name | Description |
|---|---|
A10_RemainingClusterCount HexInt64 | |
A11_ExtentsDescriptorNumberOfValidRuns HexInt32 |
Event ID 286:
#Fields #
| Name | Description |
|---|---|
A10_RemainingClusterCount HexInt64 | |
A11_ExtentsDescriptorNumberOfValidRuns HexInt32 |
Event ID 287:
#Fields #
| Name | Description |
|---|---|
A10_ExtentsDescriptorNumberOfValidRuns HexInt32 | |
A11_MaxRuns HexInt32 | |
A12_Status HexInt32 | |
A13_BytesReturned HexInt64 |
Event ID 288:
#Fields #
| Name | Description |
|---|---|
A10_ExtentsDescriptorRunIndexBasePage HexInt64 | |
A11_ExtentsDescriptorRunIndexPageCount HexInt64 |
Event ID 291:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_CcbFlags HexInt32 |
Event ID 292:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_ARGUMENT_PRESENTCcbCcbAccessFlags0 HexInt32 | |
A20_ARGUMENT_PRESENTCreateContextCreateContextPreviouslyGrantedAccess0 HexInt32 |
Event ID 293:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_CcbFlags HexInt32 |
Event ID 294:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_CcbNULLCcbFlags0 HexInt32 |
Event ID 295:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_ScbVcbVpbRealDeviceFlags HexInt32 |
Event ID 296:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_RenameCleanupTargetLinkFcb Pointer | |
A15_NtfsFullFileRefNumber_RenameCleanupTargetLinkFcbFileReference HexInt64 | |
A16_RenameCleanupTargetLinkFcbFcbState HexInt32 |
Event ID 297:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_RenameCleanupTargetLinkFcb Pointer | |
A15_NtfsFullFileRefNumber_RenameCleanupTargetLinkFcbFileReference HexInt64 | |
A16_RenameCleanupTargetLinkFcbTxfFcbTxfNumWriters Int32 |
Event ID 298:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_LcbToDeleteFcb Pointer | |
A15_NtfsFullFileRefNumber_LcbToDeleteFcbFileReference HexInt64 | |
A16_LcbToDelete Pointer | |
A17_WppCountedStringWLcbToDeleteFileNameAttrFileNameUSHORTLcbToDeleteFileNameAttrFileNameLength CountedUtf16String | |
A18_LcbToDeleteTxfNumWriters Int32 |
Event ID 299:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_RenameCleanupTargetLinkFcb Pointer | |
A15_NtfsFullFileRefNumber_RenameCleanupTargetLinkFcbFileReference HexInt64 | |
A16_RenameCleanupTargetLinkFcbCleanupCount Int32 |
Event ID 300:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_LcbToDeleteFcb Pointer | |
A15_NtfsFullFileRefNumber_LcbToDeleteFcbFileReference HexInt64 | |
A16_LcbToDelete Pointer | |
A17_WppCountedStringWLcbToDeleteFileNameAttrFileNameUSHORTLcbToDeleteFileNameAttrFileNameLength CountedUtf16String | |
A18_LcbToDeleteCleanupCount Int32 | |
A19_SplitPrimaryLcb Pointer | |
A20_SplitPrimaryLcbNULLWppCountedStringWSplitPrimaryLcbFileNameAttrFileNameUSHORTSplitPrimaryLcbFileNameAttrFileNameLengthWppCountedStringWNULL0 CountedUtf16String | |
A21_SplitPrimaryLcbNULLSplitPrimaryLcbCleanupCount0 Int32 |
Event ID 301:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_LcbFcb Pointer | |
A15_NtfsFullFileRefNumber_LcbFcbFileReference HexInt64 | |
A16_LcbFcbFcbState HexInt32 | |
A17_Lcb Pointer | |
A18_WppCountedStringWLcbFileNameAttrFileNameUSHORTLcbFileNameAttrFileNameLength CountedUtf16String | |
A19_LcbFileNameAttrFlags HexInt32 | |
A20_LcbLcbState HexInt32 |
Event ID 302:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_ScbFcbInfoFileAttributes HexInt32 |
Event ID 303:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_TargetParentScbFcb Pointer | |
A15_NtfsFullFileRefNumber_TargetParentScbFcbFileReference HexInt64 | |
A16_TargetParentScbFcbFcbState HexInt32 |
Event ID 304:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_TargetParentScbFcb Pointer | |
A15_NtfsFullFileRefNumber_TargetParentScbFcbFileReference HexInt64 | |
A16_TargetParentScbFcbInfoFileAttributes HexInt32 | |
A17_TargetParentScbFcbFcbState HexInt32 |
Event ID 305:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 |
Event ID 306:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_NtfsFullFileRefNumber_TargetParentScbFcbFileReference HexInt64 |
Event ID 307:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String |
Event ID 308:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_TxfVisibleLinks Int32 |
Event ID 309:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_AccessStatus HexInt32 |
Event ID 310:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_TargetParentScbFcb Pointer | |
A15_NtfsFullFileRefNumber_TargetParentScbFcbFileReference HexInt64 | |
A16__NewLinkName CountedUtf16String |
Event ID 311:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_TargetParentScbFcb Pointer | |
A15_NtfsFullFileRefNumber_TargetParentScbFcbFileReference HexInt64 | |
A16__NewLinkName CountedUtf16String | |
A17_TargetParentScbFcbTxfRmcbRmState HexInt32 |
Event ID 312:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_LcbFcb Pointer | |
A15_NtfsFullFileRefNumber_LcbFcbFileReference HexInt64 | |
A16_Lcb Pointer | |
A17_WppCountedStringWLcbFileNameAttrFileNameUSHORTLcbFileNameAttrFileNameLength CountedUtf16String |
Event ID 313:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_LcbFcb Pointer | |
A15_NtfsFullFileRefNumber_LcbFcbFileReference HexInt64 | |
A16_Lcb Pointer | |
A17_WppCountedStringWLcbFileNameAttrFileNameUSHORTLcbFileNameAttrFileNameLength CountedUtf16String | |
A18_NtfsFullFileRefNumber_ParentScbFcbFileReference HexInt64 |
Event ID 314:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_NextScbVcb Pointer | |
A12__NextScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWNextScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHNextScbVcbVpb CountedUtf16String | |
A14_NextScbFcb Pointer | |
A15_NtfsFullFileRefNumber_NextScbFcbFileReference HexInt64 | |
A16_NextScbCleanupCount Int32 |
Event ID 315:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_NextScbVcb Pointer | |
A12__NextScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWNextScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHNextScbVcbVpb CountedUtf16String | |
A14_NextScbFcb Pointer | |
A15_NtfsFullFileRefNumber_NextScbFcbFileReference HexInt64 | |
A16_ByIdCcbs Int32 | |
A17_NextScbCleanupCount Int32 |
Event ID 316:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_ScbState HexInt32 | |
A20_ScbScbTypeDataHighWaterMark Int64 |
Event ID 317:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_DirectoryScbVcb Pointer | |
A12__DirectoryScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWDirectoryScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHDirectoryScbVcbVpb CountedUtf16String | |
A14_DirectoryScbFcb Pointer | |
A15_NtfsFullFileRefNumber_DirectoryScbFcbFileReference HexInt64 | |
A16_ULONGIrpIoStatusInformation Int32 | |
A17_BatchOplockCount Int32 |
Event ID 318:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12_Fcb Pointer | |
A13_LocalFlagsEntireFlags HexInt32 |
Event ID 320:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12_LocalFlagsEntireFlags HexInt32 |
Event ID 323:
#Fields #
| Name | Description |
|---|---|
A10_PNTFS_DISK_FLUSH_CONTEXTContextVcb Pointer | |
A11_Context Pointer |
Event ID 324:
#Fields #
| Name | Description |
|---|---|
A10_PNTFS_DISK_FLUSH_CONTEXTContextVcb Pointer | |
A11_Context Pointer | |
A12_NtfsDataDiskFlushContextCompletedWorkItemListFlink Pointer |
Event ID 325:
#Event ID 326:
#Event ID 327:
#Fields #
| Name | Description |
|---|---|
A10_Irp Pointer | |
A11_IrpContext Pointer | |
A12_IrpContextVcb Pointer | |
A13_IrpSpMinorFunction HexInt32 | |
A14_FsControlCode HexInt32 |
Event ID 328:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbVcbState HexInt32 | |
A15_VcbDisallowDismountCount Int32 | |
A16_ExplicitLock10 Int32 | |
A17_ReadULongNoFence_VcbCleanupCount Int32 | |
A18_UserHandleCountSystemHandleCountVcbExternalMetadataCleanupCount Int32 |
Event ID 329:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbVcbState HexInt32 |
Event ID 330:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Status HexInt32 |
Event ID 331:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Status HexInt32 |
Event ID 332:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbCloseCount Int32 | |
A15_VcbSystemFileCloseCount Int32 | |
A16_UserHandleCount Int32 |
Event ID 333:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 334:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ActiveRmCount Int32 | |
A15_DefaultRmActive10 Int32 |
Event ID 335:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDVcbTxfVcbDefaultRm Pointer | |
A12_VcbTxfVcbDefaultRmNULL_VcbTxfVcbDefaultRmRmIdNULL GUID |
Event ID 336:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 337:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12__VolumeLabel CountedUtf16String | |
A13__VcbDeviceName CountedUtf16String |
Event ID 338:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 339:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbVcbState HexInt32 |
Event ID 340:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbVcbState HexInt32 | |
A15_VcbReadOnlyCloseCount Int32 | |
A16_VcbCloseCount Int32 | |
A17_VcbSystemFileCloseCount Int32 |
Event ID 341:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbVcbState HexInt32 |
Event ID 342:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 343:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 344:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbAccessFlags HexInt32 |
Event ID 345:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbAccessFlags HexInt32 |
Event ID 346:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbAccessFlags HexInt32 |
Event ID 347:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 | |
A15_TypeOfOpen Int32 |
Event ID 348:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 | |
A15_IrpRequestorMode Int32 |
Event ID 349:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 350:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 351:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbAccessFlags HexInt32 | |
A15_CcbFlags HexInt32 |
Event ID 352:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbAccessFlags HexInt32 | |
A15_CcbFlags HexInt32 | |
A16_CallerId Int32 | |
A17_ContextOwnerId Int32 |
Event ID 353:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 | |
A18_FileObjectWriteAccess10 Int32 |
Event ID 354:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 | |
A18_ScbAttributeFlags HexInt32 |
Event ID 355:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ZeroFlags HexInt32 | |
A12_IrpRequestorMode Int32 |
Event ID 356:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Scb Pointer | |
A12_IrpSpFileObject Pointer |
Event ID 358:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 |
Event ID 359:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 |
Event ID 360:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 361:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 362:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 365:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 | |
A18_HandleInfoHandleInfo HexInt32 | |
A19_IrpRequestorMode Int32 |
Event ID 366:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_DasdCcbNULLDasdCcbAccessFlags0 HexInt32 |
Event ID 367:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_ScbPersist HexInt32 | |
A20_HandleInfoHandleInfo HexInt32 |
Event ID 368:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_FcbFcbState2 HexInt32 | |
A17_Scb Pointer | |
A18_ScbAttributeTypeCode HexInt32 | |
A19__ScbAttributeName CountedUtf16String | |
A20_ScbPersist HexInt32 | |
A21_HandleInfoHandleInfo HexInt32 |
Event ID 369:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_FcbFcbState HexInt32 | |
A17_Scb Pointer | |
A18_ScbAttributeTypeCode HexInt32 | |
A19__ScbAttributeName CountedUtf16String | |
A20_ScbPersist HexInt32 | |
A21_HandleInfoHandleInfo HexInt32 | |
A22_IrpRequestorMode Int32 |
Event ID 370:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_ScbFcbFcbState HexInt32 | |
A17_HandleInfoHandleInfo HexInt32 |
Event ID 371:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_HandleInfoHandleInfo HexInt32 |
Event ID 372:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_ScbShareAccessWriters Int32 |
Event ID 373:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 374:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_TypeOfOpen Int32 | |
A15_IrpSpFileObjectWriteAccess10 Int32 | |
A16_ScbFcb Pointer | |
A17_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A18_ScbAttributeTypeCode HexInt32 | |
A19_ScbFcbFcbState HexInt32 | |
A20_CcbNULL_CcbFullFileNameNULL CountedUtf16String |
Event ID 375:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 377:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 378:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 379:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_IrpContextVcb Pointer | |
A12__IrpContextVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWIrpContextVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHIrpContextVcbVpb CountedUtf16String | |
A14_NtfsDataFlags HexInt32 |
Event ID 380:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 382:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 383:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 384:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_IrpContextVcb Pointer | |
A12__IrpContextVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWIrpContextVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHIrpContextVcbVpb CountedUtf16String |
Event ID 385:
#Fields #
| Name | Description |
|---|---|
A10_ScrubResumeContextSystemScbIndex UInt32 | |
A11_ScrubResumeContextResumeVcn HexInt64 | |
A12_ScrubResumeContextResumeVcnOffset HexInt32 |
Event ID 386:
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_ScrubResumeContextResumeVcn HexInt64 | |
A12_ScrubResumeContextResumeVcnOffset HexInt32 |
Event ID 388:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_TypeOfOpen Int32 | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17__CcbFullFileName CountedUtf16String | |
A18_CcbAccessFlags HexInt32 |
Event ID 390:
#Event ID 391:
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_ScrubContextOperationStatus HexInt32 | |
A12_ScrubContextNumberOfBytesRepaired HexInt64 | |
A13_ScrubContextNumberOfBytesFailed HexInt64 | |
A14_ScrubContextErrorFileOffset HexInt64 | |
A15_ScrubContextErrorLength HexInt64 | |
A16_ScrubContextParityExtentDataNumberOfParityExtents UInt32 |
Event ID 392:
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_Status HexInt32 | |
A12_ScrubContextNumberOfBytesRepaired HexInt64 | |
A13_ScrubContextNumberOfBytesFailed HexInt64 | |
A14_ScrubContextParityExtentDataNumberOfParityExtents UInt32 |
Event ID 395:
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_ScrubIoCount UInt32 | |
A12_IrpCancel UInt32 | |
A13_ScrubContextParityExtentDataNumberOfParityExtents UInt32 |
Event ID 399:
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_FileScrubOffset HexInt64 | |
A12_SectorAlignedVdl HexInt64 |
Event ID 401:
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_StartingVcn HexInt64 | |
A12_ClusterCount HexInt64 |
Event ID 403:
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_DsmRangeStartingOffset HexInt64 | |
A12_DsmRangeStartingOffsetDsmRangeLengthInBytes HexInt64 | |
A13_DsmRangeLengthInBytes HexInt64 | |
A14_StartingVcn HexInt64 | |
A15_StartingVcnOffset HexInt32 | |
A16_SectorAlignedVdl HexInt64 |
Event ID 404:
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_StartingVcn HexInt64 | |
A12_ScrubContextErrorFileOffset HexInt64 | |
A13_ScrubbedLength HexInt64 | |
A14_ScrubContextOperationStatus HexInt32 | |
A15_ScrubContextNumberOfBytesFailed HexInt64 | |
A16_ScrubContextNumberOfBytesRepaired HexInt64 | |
A17_NewParityExtentCount UInt32 |
Event ID 410:
#Event ID 411:
#Event ID 414:
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_StartingVcn HexInt64 | |
A12_ClusterCount HexInt64 |
Event ID 415:
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_RepairDataSetRangeStartingOffset HexInt64 | |
A12_RepairDataSetRangeStartingOffsetRepairDataSetRangeLengthInBytes HexInt64 | |
A13_RepairDataSetRangeLengthInBytes HexInt64 | |
A14_RepairFileOffset HexInt64 |
Event ID 419:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_TypeOfOpen Int32 | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17__CcbFullFileName CountedUtf16String | |
A18_CcbAccessFlags HexInt32 |
Event ID 420:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_TypeOfOpen Int32 | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 421:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_TypeOfOpen Int32 | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 422:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_TypeOfOpen Int32 | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 423:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String |
Event ID 424:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_TypeOfOpen Int32 | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_IrpRequestorMode Int32 |
Event ID 425:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_VcbVcbState HexInt32 |
Event ID 426:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_ScbPersist HexInt32 | |
A20_CcbNULLCcbFlags0 HexInt32 |
Event ID 427:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_FcbInfoFileAttributes HexInt32 | |
A17_IrpSpFlags HexInt32 |
Event ID 428:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A17_IrpRequestorMode Int32 |
Event ID 429:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A17_VcbVcbState HexInt32 |
Event ID 430:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_ScbPersist HexInt32 | |
A20_CcbNULLCcbFlags0 HexInt32 |
Event ID 431:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_FcbInfoFileAttributes HexInt32 | |
A17_IrpSpFlags HexInt32 |
Event ID 432:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A15_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A16_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 433:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_ScbAttributeTypeCode HexInt32 | |
A18_ScbFcbFcbState2 HexInt32 | |
A19_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A20_CcbNULLCcbAccessFlags0 HexInt32 | |
A21_CcbNULLCcbFlags20 HexInt32 |
Event ID 434:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_ScbAttributeTypeCode HexInt32 | |
A18_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A19_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 435:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A17_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 436:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_PsGetCurrentThread Pointer | |
A12_Status HexInt32 | |
A13__DeletedFiles CountedUtf16String |
Event ID 437:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_PsGetCurrentThread Pointer | |
A12_Status HexInt32 |
Event ID 438:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_PsGetCurrentThread Pointer | |
A12_Status HexInt32 | |
A13__FileNameToDelete CountedUtf16String |
Event ID 439:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_PsGetCurrentThread Pointer | |
A12_Status HexInt32 |
Event ID 440:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_PsGetCurrentThread Pointer | |
A12_Status HexInt32 |
Event ID 441:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_CcbNULLCcbAccessFlags0 HexInt32 | |
A19_EffectiveMode Int32 |
Event ID 442:
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_StartOffset HexInt64 | |
A12_Length HexInt64 | |
A13_StartVcn HexInt64 | |
A14_BeyondEndVcn HexInt64 |
Event ID 444:
#Fields #
| Name | Description |
|---|---|
A10_FsInputRangeIndex UInt32 | |
A11_FsInputRangesFsInputRangeIndexFileOffset HexInt64 | |
A12_FsInputRangesFsInputRangeIndexVolumeOffset HexInt64 | |
A13_FsInputRangesFsInputRangeIndexLengthInBytes HexInt64 |
Event ID 445:
#Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_Status HexInt32 | |
A12_BOOLEANAbnormalTermination UInt8 |
Event ID 447:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_IrpContextVcb Pointer | |
A12__IrpContextVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWIrpContextVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHIrpContextVcbVpb CountedUtf16String |
Event ID 448:
#Event ID 449:
#Fields #
| Name | Description |
|---|---|
A10_Table Pointer | |
A11_ParentScb Pointer | |
A12__ParentScbScbTypeIndexNormalizedName CountedUtf16String | |
A13_RemainingName CountedUtf16String |
Event ID 450:
#Event ID 451:
#Fields #
| Name | Description |
|---|---|
A10_FoundLcb Pointer | |
A11__FoundLcbExactCaseLinkLinkName CountedUtf16String |
Event ID 452:
#Event ID 453:
#Fields #
| Name | Description |
|---|---|
A10_Table Pointer | |
A11_NewHashEntryHashValue HexInt32 | |
A12_NewHashEntryFullNameLength Int32 | |
A13_NewHashEntryHashLcb Pointer | |
A14__NewHashEntryHashLcbExactCaseLinkLinkName CountedUtf16String |
Event ID 454:
#Fields #
| Name | Description |
|---|---|
A10_Table Pointer | |
A11_HashValue HexInt32 | |
A12_HashLcb Pointer | |
A13__HashLcbExactCaseLinkLinkName CountedUtf16String |
Event ID 456:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_PercentFull Int32 | |
A12_VcbWaitForCcLoggedDataActivityCount Int32 |
Event ID 464:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_NtfsFullSegmentNumber_ScbFcbFileReference HexInt64 |
Event ID 466:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbVcbState HexInt32 |
Event ID 471:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_IrpContextOriginatingIrp Pointer | |
A12_PsGetCurrentThread Pointer | |
A13_IrpContextExceptionStatus HexInt32 |
Event ID 472:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_IrpContextOriginatingIrp Pointer | |
A12_PsGetCurrentThread Pointer | |
A13_IrpContextExceptionStatus HexInt32 |
Event ID 473:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_IrpContextOriginatingIrp Pointer | |
A12_PsGetCurrentThread Pointer | |
A13_IrpContextExceptionStatus HexInt32 | |
A14_FailedFlushCount Int32 |
Event ID 474:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_IrpContextOriginatingIrp Pointer | |
A12_PsGetCurrentThread Pointer | |
A13_IrpContextExceptionStatus HexInt32 |
Event ID 475:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_IrpContextOriginatingIrp Pointer | |
A12_PsGetCurrentThread Pointer | |
A13_IrpContextExceptionStatus HexInt32 |
Event ID 478:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_ActiveLsnQuadPart HexInt64 | |
A12_ClearAll UInt32 |
Event ID 484:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_Clusters Pointer | |
A12_ClustersClusterCount HexInt64 | |
A13_ClustersLsnQuadPart HexInt64 | |
A14_ClustersFlags HexInt32 |
Event ID 485:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_Clusters Pointer | |
A12_i Int32 | |
A13_StartingLcn HexInt64 | |
A14_ClusterCount HexInt64 |
Event ID 486:
#Event ID 491:
#Event ID 492:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_StartingLcn HexInt64 | |
A12_ULONGClusterCount HexInt32 |
Event ID 493:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_StartingLcnStartingIndex HexInt64 | |
A12_runLength HexInt32 |
Event ID 497:
#Fields #
| Name | Description |
|---|---|
A10_McbScb Pointer | |
A11_Mcb Pointer | |
A12_StartingVcn HexInt64 | |
A13_Count HexInt64 |
Event ID 499:
#Fields #
| Name | Description |
|---|---|
A10_McbScb Pointer | |
A11_Mcb Pointer | |
A12_Vcn HexInt64 | |
A13_Lcn HexInt64 | |
A14_RunCount HexInt64 |
Event ID 501:
#Fields #
| Name | Description |
|---|---|
A10_McbScb Pointer | |
A11_Mcb Pointer | |
A12_StartingVcn HexInt64 | |
A13_EndingVcn HexInt64 | |
A14_TruncateOnly UInt32 |
Event ID 505:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_IrpContextExceptionStatus HexInt32 |
Event ID 506:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12__VolumeLabel CountedUtf16String | |
A13__VcbDeviceName CountedUtf16String |
Event ID 510:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_AttrListAllocationSize HexInt64 |
Event ID 511:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_AttrListAllocationSize HexInt64 |
Event ID 515:
#Fields #
| Name | Description |
|---|---|
A10_IrpContextLogFullReason UInt32 | |
A11_BackTrace0 Pointer | |
A12_BackTrace1 Pointer | |
A13_BackTrace2 Pointer | |
A14_BackTrace3 Pointer | |
A15_BackTrace4 Pointer | |
A16_BackTrace5 Pointer | |
A17_BackTrace6 Pointer | |
A18_BackTrace7 Pointer | |
A19_BackTrace8 Pointer | |
A20_BackTrace9 Pointer | |
A21_BackTrace10 Pointer | |
A22_BackTrace11 Pointer | |
A23_BackTrace12 Pointer | |
A24_BackTrace13 Pointer | |
A25_BackTrace14 Pointer | |
A26_BackTrace15 Pointer | |
A27_BackTrace16 Pointer | |
A28_BackTrace17 Pointer | |
A29_BackTrace18 Pointer | |
A30_BackTrace19 Pointer |
Event ID 519:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Irp Pointer | |
A12_IrpContextVcb Pointer | |
A13_NtfsFailedAborts HexInt32 | |
A14_GetExceptionCode HexInt32 |
Event ID 520:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Irp Pointer | |
A12_IrpContextVcb Pointer | |
A13_NextScb Pointer | |
A14_PULONGLONG_NextScbFcbFileReference HexInt64 |
Event ID 521:
#Fields #
| Name | Description |
|---|---|
A10_IrpSpParametersWriteByteOffsetHighPart HexInt32 | |
A11_IrpSpParametersWriteByteOffsetLowPart HexInt32 |
Event ID 522:
#Fields #
| Name | Description |
|---|---|
A10_ExceptionCode HexInt32 | |
A11_IrpSpParametersWriteByteOffsetHighPart HexInt32 | |
A12_IrpSpParametersWriteByteOffsetLowPart HexInt32 |
Event ID 523:
#Fields #
| Name | Description |
|---|---|
A10_IrpSpMajorFunction UInt32 | |
A11_IrpSpMinorFunction HexInt32 | |
A12_Irp Pointer | |
A13_IrpContext Pointer | |
A14_Status HexInt32 |
Event ID 524:
#Fields #
| Name | Description |
|---|---|
A10_IrpSpMajorFunction UInt32 | |
A11_IrpSpMinorFunction HexInt32 | |
A12_Irp Pointer | |
A13_IrpContext Pointer | |
A14_Status HexInt32 |
Event ID 525:
#Event ID 526:
#Event ID 529:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 | |
A18_IrpSpMinorFunction HexInt32 |
Event ID 530:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 | |
A18_IrpSpMinorFunction HexInt32 |
Event ID 531:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 | |
A18_IrpSpMinorFunction HexInt32 |
Event ID 532:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDVcbTxfVcbDefaultRm Pointer | |
A12__VcbTxfVcbDefaultRmRmId GUID |
Event ID 533:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_IrpContextVcb Pointer | |
A12__IrpContextVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWIrpContextVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHIrpContextVcbVpb CountedUtf16String |
Event ID 534:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_ScbFcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17__CcbFullFileName CountedUtf16String | |
A18_CcbAccessFlags HexInt32 | |
A19_CcbFlags HexInt32 |
Event ID 536:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 | |
A18_IrpSpFileObjectWriteAccess Int32 |
Event ID 537:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 | |
A18_IrpSpFileObjectWriteAccess Int32 |
Event ID 538:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 | |
A18_IrpSpFileObjectWriteAccess Int32 |
Event ID 539:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_VcbLogFileObject Pointer | |
A12_IrpContext Pointer |
Event ID 541:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_VcbLogFileObject Pointer | |
A12_IrpContext Pointer |
Event ID 544:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_FileRecordSegmentNumberHighPart HexInt32 | |
A12_FileRecordSegmentNumberLowPart HexInt32 | |
A13_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 |
Event ID 545:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_FileRecordSegmentNumberHighPart HexInt32 | |
A12_FileRecordSegmentNumberLowPart HexInt32 | |
A13_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 |
Event ID 546:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_FileRecordSegmentNumberHighPart HexInt32 | |
A12_FileRecordSegmentNumberLowPart HexInt32 | |
A13_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 | |
A14_AttributeTypeCode HexInt32 | |
A15_LogRecordRecordOffset HexInt32 | |
A16_Length HexInt32 |
Event ID 547:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_FileRecordSegmentNumberHighPart HexInt32 | |
A12_FileRecordSegmentNumberLowPart HexInt32 | |
A13_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 | |
A14_PATTRIBUTE_RECORD_HEADERDataTypeCode HexInt32 |
Event ID 548:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_FileRecordSegmentNumberHighPart HexInt32 | |
A12_FileRecordSegmentNumberLowPart HexInt32 | |
A13_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 | |
A14_NtfsFullSegmentNumber_FileReference HexInt64 |
Event ID 549:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_FileRecordSegmentNumberHighPart HexInt32 | |
A12_FileRecordSegmentNumberLowPart HexInt32 | |
A13_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 | |
A14_AttributeFormNonresidentAllocatedLength HexInt64 | |
A15_AttributeFormNonresidentFileSize HexInt64 | |
A16_AttributeFormNonresidentValidDataLength HexInt64 | |
A17_AttributeFormNonresidentTotalAllocated HexInt64 | |
A18_SizesAllocationSize HexInt64 | |
A19_SizesFileSize HexInt64 | |
A20_SizesValidDataLength HexInt64 | |
A21_SizesTotalAllocated HexInt64 |
Event ID 552:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 |
Event ID 553:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String | |
A17_CcbAccessFlags HexInt32 |
Event ID 554:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16__CcbFullFileName CountedUtf16String |
Event ID 555:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisFcbTxfFcbTxfNumWriters Int32 |
Event ID 556:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_Status HexInt32 |
Event ID 557:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisFcbInfoFileAttributes HexInt32 |
Event ID 558:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisFcbInfoFileAttributes HexInt32 |
Event ID 559:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 |
Event ID 560:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_ThisFcbInfoFileAttributes HexInt32 | |
A17_IrpSpFlags HexInt32 |
Event ID 561:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_CcbAccessFlags HexInt32 | |
A17_AccessStatus HexInt32 |
Event ID 562:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ThisFcbVcb Pointer | |
A12__ThisFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | |
A14_ThisFcb Pointer | |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | |
A16_NextScb Pointer | |
A17_NextScbAttributeTypeCode HexInt32 | |
A18__NextScbAttributeName CountedUtf16String |
Event ID 563:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A17_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 564:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbVcbState HexInt32 |
Event ID 565:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A17_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 566:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A17_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 567:
#Event ID 568:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_Fcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 569:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_Fcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 570:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_Fcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 571:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_FcbFcbState HexInt32 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String |
Event ID 572:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A17_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 573:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A17_CcbNULLCcbAccessFlags0 HexInt32 | |
A18_Flags HexInt32 |
Event ID 574:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A17_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 578:
#Fields #
| Name | Description |
|---|---|
A10_CurrentClusters Pointer | |
A11_CurrentClustersLsnQuadPart HexInt64 |
Event ID 579:
#Fields #
| Name | Description |
|---|---|
A10_ClustersLinkAsHead Pointer | |
A11_FlagsToMatch HexInt32 | |
A12_InsertAfter UInt32 |
Event ID 583:
#Event ID 584:
#Fields #
| Name | Description |
|---|---|
A10_FlagOnClustersFlagsDEALLOCATED_CLUSTERS_FLAG_NO_DANGLING_MDL UInt32 | |
A11_Clusters Pointer | |
A12_Lcn HexInt64 | |
A13_ClusterCount HexInt64 |
Event ID 585:
#Fields #
| Name | Description |
|---|---|
A10_FlagOnClustersFlagsDEALLOCATED_CLUSTERS_FLAG_NO_DANGLING_MDL UInt32 | |
A11_Clusters Pointer | |
A12_Lcn HexInt64 | |
A13_ClusterCount HexInt64 |
Event ID 586:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_TxfFcbFlags HexInt32 | |
A17_ShareMode HexInt32 |
Event ID 587:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_GrantedAccess HexInt32 |
Event ID 588:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_GrantedAccess HexInt32 |
Event ID 589:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_GrantedAccess HexInt32 | |
A17_NextTxfVscbReaderCleanupCount Int32 |
Event ID 590:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_CallerFunction AnsiString | |
A12_CallerFile AnsiString | |
A13_CallerLineNumber Int32 | |
A14_PVOIDTxfRmcb Pointer | |
A15__TxfRmcbRmId GUID | |
A16_PVOIDTxfTrans Pointer | |
A17__TxfTransKtmUow GUID | |
A18_AbortReasonStatus HexInt32 |
Event ID 591:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_CallerFunction AnsiString | |
A12_CallerFile AnsiString | |
A13_CallerLineNumber Int32 | |
A14_PVOIDTxfRmcb Pointer | |
A15__TxfRmcbRmId GUID | |
A16_PVOIDTxfTrans Pointer | |
A17__TxfTransKtmUow GUID | |
A18_Status HexInt32 |
Event ID 592:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_TxfTrans Pointer | |
A14__TxfTransKtmUow GUID |
Event ID 593:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_TxfTrans Pointer | |
A14__TxfTransKtmUow GUID |
Event ID 594:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDCalloutParametersTxfFlushTxfRmcb Pointer | |
A12__CalloutParametersTxfFlushTxfRmcbRmId GUID | |
A13_GetExceptionCode HexInt32 |
Event ID 605:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbTxfVcbFlags HexInt32 |
Event ID 606:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_TempStatus HexInt32 | |
A12_PVOIDVcb Pointer |
Event ID 607:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_GetExceptionCode HexInt32 | |
A12_Status HexInt32 | |
A13_PVOIDVcb Pointer |
Event ID 608:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDVcb Pointer | |
A12_TXF_MAX_RESET_ATTEMPTS_ON_MOUNT Int32 | |
A13_OldStatus HexInt32 |
Event ID 609:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_GetExceptionCode HexInt32 | |
A12_PVOIDVcb Pointer |
Event ID 610:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_NT_SUCCESSStatusSucceededFAILED AnsiString | |
A12_PVOIDTxfRmcb Pointer | |
A13__TxfRmcbRmId GUID | |
A14_Status HexInt32 |
Event ID 611:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 612:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 613:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 614:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbTxfVcbFlags HexInt32 |
Event ID 615:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 616:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_VcbTxfVcbFlags HexInt32 |
Event ID 617:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 618:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_LogNestingLevel HexInt32 | |
A14_DiskNestingLevel HexInt32 |
Event ID 619:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 620:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 621:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13__ClfsRestartAreaRmId GUID |
Event ID 622:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_Status Int32 | |
A12_PVOIDTxfRmcb Pointer | |
A13__TxfRmcbRmId GUID |
Event ID 623:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 624:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 625:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 626:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_Status HexInt32 | |
A14_AbnormalTerminationabnormaltermination AnsiString |
Event ID 627:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_TxfIsDefaultRmTxfRmcbdefaultsecondary AnsiString | |
A12_PVOIDTxfRmcb Pointer | |
A13__TxfRmcbRmId GUID | |
A14_ForceDirtyShutdownDIRTYCLEAN AnsiString |
Event ID 628:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 629:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | |
A16_FcbCleanupCount Int32 |
Event ID 630:
#Fields #
| Name | Description |
|---|---|
A10_FILEID_FROM_SOURCEFileNLine UInt32 | |
A11_LINENUM_FROM_SOURCEFileNLine Int32 | |
A12_TxfRmcb Pointer | |
A13__TxfRmcbRmId GUID | |
A14_Status HexInt32 |
Event ID 631:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__OldGuid GUID | |
A13__TxfRmcbRmId GUID |
Event ID 632:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_PVOIDTxfTrans Pointer | |
A14__TxfTransKtmUow GUID | |
A15_Status HexInt32 |
Event ID 633:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__OldGuid GUID | |
A13__TxfRmcbRmId GUID |
Event ID 634:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_RmRootFcbVcb Pointer | |
A12__RmRootFcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWRmRootFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHRmRootFcbVcbVpb CountedUtf16String | |
A14_RmRootFcb Pointer |
Event ID 635:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_FcbVcb Pointer | |
A12__FcbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | |
A14_BackupInfoFlags HexInt32 |
Event ID 636:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 637:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_Status HexInt32 | |
A12_PVOIDFileObject Pointer |
Event ID 638:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 639:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__CcbFullFileName CountedUtf16String | |
A19_CcbFlags HexInt32 |
Event ID 640:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_CcbTxfFo Pointer | |
A18_CcbTxfFoKtmTrans Pointer | |
A19_ScbFcbTxfRmcb Pointer | |
A20_CcbFullFileNameBuffer UnicodeString |
Event ID 641:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17__CcbFullFileName CountedUtf16String | |
A18_CcbAccessFlags HexInt32 | |
A19_FileObjectWriteAccess Int32 | |
A20_FileObjectDeleteAccess Int32 |
Event ID 642:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_ExceptionCode HexInt32 |
Event ID 643:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_TransactionNotification HexInt32 | |
A12_TransactionAlreadyPreparedPREPARED AnsiString | |
A13__TxfTransKtmUow GUID | |
A14_PVOIDTxfRmcb Pointer | |
A15__TxfRmcbRmId GUID | |
A16_Status HexInt32 |
Event ID 644:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_TxfTrans Pointer | |
A14__TxfTransKtmUow GUID |
Event ID 645:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_TxfTrans Pointer | |
A14__TxfTransKtmUow GUID |
Event ID 646:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTransTxfRmcb Pointer | |
A12__TransTxfRmcbRmId GUID | |
A13_FlushStatus HexInt32 |
Event ID 647:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_Trans Pointer | |
A14__TransKtmUow GUID |
Event ID 648:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_CallStack0 Pointer | |
A12_CallStack1 Pointer | |
A13_CallStack2 Pointer | |
A14_CallStack3 Pointer | |
A15_CallStack4 Pointer |
Event ID 649:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_Trans Pointer | |
A14__TransKtmUow GUID |
Event ID 650:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_Status HexInt32 | |
A12_PVOIDTrans Pointer | |
A13__TransKtmUow GUID | |
A14_PVOIDTxfRmcb Pointer | |
A15__TxfRmcbRmId GUID |
Event ID 651:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_Status HexInt32 | |
A12_PVOIDTxfRmcb Pointer | |
A13__TxfRmcbRmId GUID | |
A14_PVOIDTrans Pointer | |
A15__TransKtmUow GUID |
Event ID 652:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 653:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 654:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 655:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 656:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_OldestTrans Pointer | |
A14__OldestTransKtmUow GUID |
Event ID 657:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_Status HexInt32 | |
A14_OldestTrans Pointer | |
A15__OldestTransKtmUow GUID |
Event ID 658:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 659:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 660:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_PVOIDTransToDereference Pointer | |
A14__TransToDereferenceKtmUow GUID | |
A15_Status HexInt32 |
Event ID 661:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 662:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 663:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PinnedStatus HexInt32 | |
A12_PVOIDTxfRmcb Pointer | |
A13__TxfRmcbRmId GUID | |
A14_Status HexInt32 |
Event ID 664:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 665:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 666:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 667:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 668:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 669:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 670:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 671:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 672:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 673:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 674:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID | |
A13_IsEncrypted_TopsFcbInfoencryptedcompressed AnsiString |
Event ID 675:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 676:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 677:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 678:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 679:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 680:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 681:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 682:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 683:
#Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_PVOIDTxfRmcb Pointer | |
A12__TxfRmcbRmId GUID |
Event ID 684:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_Fcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 685:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_VcbFirstValidUsn HexInt64 | |
A13_FirstValidUsn HexInt64 | |
A14_TrackUsnJournalFileSize HexInt64 | |
A15_TrackUsnJournalAllocationSize HexInt64 | |
A16_TrackUsnJournalMaxSize HexInt64 | |
A17_TrackUsnJournalDeltaAllocation HexInt64 |
Event ID 686:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_FirstValidUsn1 HexInt64 | |
A13_SavedReserved HexInt64 | |
A14_RequiredReserved HexInt64 |
Event ID 687:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_UsnJournalHeaderAllocationSizeQuadPart HexInt64 | |
A13_UsnJournalHeaderFileSizeQuadPart HexInt64 | |
A14_UsnJournalHeaderValidDataLengthQuadPart HexInt64 | |
A15_UsnJournalTotalAllocated HexInt64 |
Event ID 688:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_UsnJournalHeaderAllocationSizeQuadPart HexInt64 | |
A13_UsnJournalHeaderFileSizeQuadPart HexInt64 | |
A14_UsnJournalHeaderValidDataLengthQuadPart HexInt64 | |
A15_UsnJournalTotalAllocated HexInt64 |
Event ID 691:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_Fcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 |
Event ID 692:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_Fcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A17_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 693:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_Fcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | |
A18_CcbNULLCcbAccessFlags0 HexInt32 |
Event ID 694:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_ScbVcb Pointer | |
A12__ScbVcbVolumeName CountedUtf16String | |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | |
A14_ScbFcb Pointer | |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A16_Scb Pointer | |
A17_ScbAttributeTypeCode HexInt32 | |
A18__ScbAttributeName CountedUtf16String | |
A19_ScbCleanupCount Int32 |
Event ID 695:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_IrpContextOriginatingIrp Pointer | |
A13_PsGetCurrentThread Pointer | |
A14_ScbHeaderAllocationSizeQuadPart HexInt64 | |
A15_ScbHeaderFileSizeQuadPart HexInt64 | |
A16_ScbHeaderValidDataLengthQuadPart HexInt64 | |
A17_NewAllocationSize HexInt64 |
Event ID 696:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_IrpContextOriginatingIrp Pointer | |
A13_PsGetCurrentThread Pointer | |
A14_ScbHeaderAllocationSizeQuadPart HexInt64 | |
A15_ScbHeaderFileSizeQuadPart HexInt64 | |
A16_ScbHeaderValidDataLengthQuadPart HexInt64 | |
A17_ScbTotalAllocated HexInt64 |
Event ID 697:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_IrpContextOriginatingIrp Pointer | |
A13_PsGetCurrentThread Pointer |
Event ID 698:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_IrpContextOriginatingIrp Pointer | |
A13_PsGetCurrentThread Pointer |
Event ID 699:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_IrpContextOriginatingIrp Pointer | |
A12_PsGetCurrentThread Pointer | |
A13_IrpContextExceptionStatus HexInt32 |
Event ID 700:
#Fields #
| Name | Description |
|---|---|
A10_RemainingClusterCount HexInt64 | |
A11_Scb Pointer | |
A12_Vcn HexInt64 | |
A13_Lcn HexInt64 | |
A14_ClusterCount HexInt64 |
Event ID 708:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12__VolumeLabel CountedUtf16String | |
A13__VcbDeviceName CountedUtf16String |
Event ID 709:
#Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Status HexInt32 | |
A12_FileReference Pointer | |
A13_Fcb Pointer | |
A14_Source HexInt64 | |
A15_TopLevelExceptionStatus HexInt32 |
Event ID 710:
#Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_WasDirty HexInt32 | |
A12_NtfsFullSegmentNumber_BugCheckFileReference HexInt64 | |
A13_Source HexInt64 |
Event ID 711:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_Fcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_FsInformationClass HexInt32 | |
A18_Scb Pointer |
Event ID 712:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_TypeOfOpen Int32 | |
A12_Vcb Pointer | |
A13__VcbVolumeName CountedUtf16String | |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A15_Fcb Pointer | |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | |
A17_FsInformationClass HexInt32 | |
A18_Scb Pointer |
Event ID 713:
#Fields #
| Name | Description |
|---|---|
A10_IrpSpParametersWriteByteOffsetHighPart HexInt32 | |
A11_IrpSpParametersWriteByteOffsetLowPart HexInt32 | |
A12_IrpContextTopLevelIrpContextExceptionStatus HexInt32 |
Event ID 715:
#Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | |
A11_Vcb Pointer | |
A12__VcbVolumeName CountedUtf16String | |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | |
A14_ByteRange HexInt64 | |
A15_HIGHEST_WRITABLE_SECTOR_ON_ACTIVE_VOLUMEVcbSectorSizeInfoLogicalBytesPerSector HexInt64 |