Microsoft-Windows-NtfsLog_cdac24ce683a371108c05bb363714355
708 events across 1 channel
Event ID 10 —
Fields #
| Name | Description |
|---|---|
A10_Vcn HexInt64 | — |
A11_AttributeFormNonresidentLowestVcn HexInt64 | — |
A12_AttributeFormNonresidentHighestVcn HexInt64 | — |
A13_AllocationClusters HexInt64 | — |
Event ID 11 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_Scb Pointer | — |
Event ID 12 —
Fields #
| Name | Description |
|---|---|
A10_FileObject Pointer | — |
A11_Scb Pointer | — |
A12_StartingVcn HexInt64 | — |
A13_ClusterCount HexInt64 | — |
A14_Flags HexInt32 | — |
A15_CcbForWriteExtend Pointer | — |
Event ID 13 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_FileObject Pointer | — |
A12_Scb Pointer | — |
A13_StartingVcn HexInt64 | — |
A14_ClusterCount HexInt64 | — |
A15_Flags HexInt32 | — |
A16_CcbForWriteExtend Pointer | — |
Event ID 14 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11_PurgeOffset HexInt64 | — |
Event ID 15 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11_PurgeOffset HexInt64 | — |
A12_PurgeChunkLength HexInt32 | — |
Event ID 16 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_LastVcn HexInt64 | — |
A12_AttributeInstance HexInt32 | — |
Event ID 17 —
Fields #
| Name | Description |
|---|---|
A10_NtfsFullFileRefNumber_FcbFileReference HexInt64 | — |
Event ID 18 —
Fields #
| Name | Description |
|---|---|
A10_NtfsFullFileRefNumber_FcbFileReference HexInt64 | — |
Event ID 19 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_ValueLength HexInt32 | — |
A12_AttributeFlags HexInt32 | — |
Event ID 20 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Scb Pointer | — |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | — |
A14_LastVcn HexInt64 | — |
A15_NewHighestVcn HexInt64 | — |
A16_PassCount HexInt32 | — |
Event ID 21 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Scb Pointer | — |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | — |
A14_ContextFoundAttributeAttributeFormNonresidentLowestVcn HexInt64 | — |
A15_ContextFoundAttributeAttributeFormNonresidentHighestVcn HexInt64 | — |
A16_ContextAttributeListEntryLowestVcn HexInt64 | — |
Event ID 22 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Scb Pointer | — |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | — |
A14_ContextFoundAttributeAttributeFormNonresidentLowestVcn HexInt64 | — |
A15_ContextFoundAttributeAttributeFormNonresidentHighestVcn HexInt64 | — |
A16_ContextAttributeListEntryLowestVcn HexInt64 | — |
Event ID 23 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Scb Pointer | — |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | — |
A14_ContextFoundAttributeAttributeFormNonresidentLowestVcn HexInt64 | — |
A15_ContextFoundAttributeAttributeFormNonresidentHighestVcn HexInt64 | — |
A16_ContextAttributeListEntryLowestVcn HexInt64 | — |
A17_PassCount HexInt32 | — |
Event ID 24 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Scb Pointer | — |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | — |
A14_ContextFoundAttributeAttributeFormNonresidentLowestVcn HexInt64 | — |
A15_ContextFoundAttributeAttributeFormNonresidentHighestVcn HexInt64 | — |
A16_ContextAttributeListEntryLowestVcn HexInt64 | — |
Event ID 25 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Scb Pointer | — |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | — |
A14_NtfsFrsConsolidationStatisticsMergeSkipCount HexInt32 | — |
Event ID 26 —
Fields #
| Name | Description |
|---|---|
A10_FileRecordSegmentNumberHighPart HexInt32 | — |
A11_FileRecordSegmentNumberLowPart HexInt32 | — |
A12_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 | — |
A13_AttributeTypeCode HexInt32 | — |
Event ID 27 —
Fields #
| Name | Description |
|---|---|
A10_FileRecordSegmentNumberHighPart HexInt32 | — |
A11_FileRecordSegmentNumberLowPart HexInt32 | — |
A12_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 | — |
A13_AttributeTypeCode HexInt32 | — |
Event ID 28 —
Fields #
| Name | Description |
|---|---|
A10_FcbVcb Pointer | — |
A11_IrpContext Pointer | — |
A12_PULONGLONG_FcbFileReference HexInt64 | — |
A13_StdInfoAttrListEntrySignature HexInt32 | — |
A14_StdInfoAttrListEntryLastCompactedSize HexInt32 | — |
A15_CurrentAttributeListSize HexInt32 | — |
Event ID 29 —
Fields #
| Name | Description |
|---|---|
A10_FcbVcb Pointer | — |
A11_IrpContext Pointer | — |
A12_PULONGLONG_FcbFileReference HexInt64 | — |
A13_StdInfoAttrListEntrySignature HexInt32 | — |
A14_StdInfoAttrListEntryLastCompactedSize HexInt32 | — |
A15_NewStdInfoAttrListEntryLastCompactedSize HexInt32 | — |
Event ID 30 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_i HexInt32 | — |
A12_MAX_MOVEABLE_ATTRIBUTES HexInt32 | — |
A13_AttributeTypeCode HexInt32 | — |
A14_AttributeRecordLength HexInt32 | — |
A15_AttributeInstance HexInt32 | — |
Event ID 31 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_SizeNeeded HexInt32 | — |
A12_AttributeTypeCode HexInt32 | — |
A13_AttributeRecordLength HexInt32 | — |
A14_AttributeFormCode HexInt32 | — |
A15_AttributeInstance HexInt32 | — |
Event ID 32 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_SizeNeeded HexInt32 | — |
A12_BytesToFree HexInt32 | — |
A13_MappingPairSize HexInt32 | — |
A14_NewMappingPairSize HexInt32 | — |
Event ID 33 —
Fields #
| Name | Description |
|---|---|
A10_FileRecordSegmentNumberHighPart HexInt32 | — |
A11_FileRecordSegmentNumberLowPart HexInt32 | — |
A12_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 | — |
A13_StartZero HexInt32 | — |
A14_ZeroLength HexInt32 | — |
Event ID 34 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Scb Pointer | — |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | — |
A14_ScbAttributeTypeCode HexInt32 | — |
A15__ScbAttributeName CountedUtf16String | — |
A16_NewStartVcn HexInt64 | — |
A17_NewHalfWayVcn HexInt64 | — |
A18_NewFinalVcn HexInt64 | — |
A19_PackedMode HexInt32 | — |
A20_TryPrior HexInt32 | — |
Event ID 35 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Scb Pointer | — |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | — |
A14_ScbAttributeTypeCode HexInt32 | — |
A15__ScbAttributeName CountedUtf16String | — |
A16_FileRecordSequenceNumber HexInt32 | — |
A17_FileRecordSegmentNumberLowPart HexInt32 | — |
A18_NewStartVcn HexInt64 | — |
A19_LastVcn HexInt64 | — |
A20_NewFinalVcn HexInt64 | — |
Event ID 36 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Scb Pointer | — |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | — |
A14_ScbAttributeTypeCode HexInt32 | — |
A15__ScbAttributeName CountedUtf16String | — |
A16_FileRecordSequenceNumber HexInt32 | — |
A17_FileRecordSegmentNumberLowPart HexInt32 | — |
A18_NewStartVcn HexInt64 | — |
A19_LastVcn HexInt64 | — |
A20_NewFinalVcn HexInt64 | — |
Event ID 37 —
Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Scb Pointer | — |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | — |
A14_NewFinalVcn HexInt64 | — |
Event ID 38 —
Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Scb Pointer | — |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | — |
A14_NewHalfWayVcn HexInt64 | — |
A15_RangePtr Pointer | — |
Event ID 39 —
Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Scb Pointer | — |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | — |
A14_NewHalfWayVcn HexInt64 | — |
A15_RangePtr Pointer | — |
Event ID 40 —
Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Scb Pointer | — |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | — |
A14_NtfsMcbArray Pointer | — |
A15_NtfsMcbArrayStartingVcn HexInt64 | — |
A16_NtfsMcbArrayEndingVcn HexInt64 | — |
Event ID 41 —
Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Scb Pointer | — |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | — |
A14_NtfsMcbArray Pointer | — |
A15_NtfsMcbArrayStartingVcn HexInt64 | — |
A16_NtfsMcbArrayEndingVcn HexInt64 | — |
Event ID 42 —
Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Scb Pointer | — |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | — |
A14_NtfsMcbArray Pointer | — |
A15_NtfsMcbArrayStartingVcn HexInt64 | — |
A16_NtfsMcbArrayEndingVcn HexInt64 | — |
Event ID 43 —
Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Scb Pointer | — |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | — |
A14_NtfsMcbArray Pointer | — |
A15_NtfsMcbArrayStartingVcn HexInt64 | — |
A16_NtfsMcbArrayEndingVcn HexInt64 | — |
Event ID 44 —
Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Scb Pointer | — |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | — |
A14_NewFinalVcnInMcb HexInt64 | — |
A15_NewFinalVcn HexInt64 | — |
Event ID 45 —
Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Scb Pointer | — |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | — |
A14_NewStartVcn HexInt64 | — |
A15_LastVcn HexInt64 | — |
A16_NewFinalVcn HexInt64 | — |
A17_NewFinalVcnInMcb HexInt64 | — |
A18_NumberOfRanges HexInt32 | — |
A19_DeletedNextAttribute HexInt32 | — |
A20_Mcb1StartWithNewStartVcn HexInt32 | — |
A21_Mcb1HoldNewStartVcn HexInt32 | — |
A22_Mcb2StartWithNewStartVcn HexInt32 | — |
A23_Mcb2HoldNewStartVcn HexInt32 | — |
A24_McbArraySizeInUseChange Int32 | — |
Event ID 46 —
Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Scb Pointer | — |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | — |
A14_NewStartVcn HexInt64 | — |
A15_DeletedNextAttributeNewFinalVcnInMcbLastVcn1 HexInt64 | — |
Event ID 47 —
Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Scb Pointer | — |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | — |
A14_LastVcn HexInt64 | — |
A15_NewFinalVcnInMcb HexInt64 | — |
Event ID 48 —
Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Scb Pointer | — |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | — |
A14_ScbAttributeTypeCode HexInt32 | — |
A15__ScbAttributeName CountedUtf16String | — |
A16_PULONGLONG_ContextAttributeListEntrySegmentReference HexInt64 | — |
A17_OldLowestVcn HexInt64 | — |
A18_StartVcn HexInt64 | — |
A19_NewAttributeInstance HexInt32 | — |
Event ID 49 —
Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Scb Pointer | — |
A13_PULONGLONG_ScbFcbFileReference HexInt64 | — |
A14_ScbAttributeTypeCode HexInt32 | — |
A15__ScbAttributeName CountedUtf16String | — |
A16_OldLowestVcn HexInt64 | — |
A17_StartVcn HexInt64 | — |
A18_OldHighestVcn HexInt64 | — |
A19_LastVcn HexInt64 | — |
A20_FileRecordSequenceNumber HexInt32 | — |
A21_FileRecordSegmentNumberLowPart HexInt32 | — |
Event ID 50 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
Event ID 51 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14__VolumeId CountedUtf16String | — |
A15_VcbVcbState HexInt32 | — |
Event ID 52 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Fcb Pointer | — |
A13_PULONGLONG_FcbFileReference HexInt64 | — |
A14_AllFlagsFirstRequest HexInt32 | — |
Event ID 53 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Fcb Pointer | — |
A13_PULONGLONG_FcbFileReference HexInt64 | — |
Event ID 54 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Fcb Pointer | — |
A13_PULONGLONG_FcbFileReference HexInt64 | — |
Event ID 55 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Fcb Pointer | — |
A13_PULONGLONG_FcbFileReference HexInt64 | — |
A14_FrsConsolidationContextRestartAttributeTypeCode HexInt32 | — |
A15__FrsConsolidationContextRestartAttributeName CountedUtf16String | — |
A16_FrsConsolidationContextRestartVcn HexInt64 | — |
A17_FrsConsolidationContextRestartAttributeListEntryOffset HexInt32 | — |
A18_AttributeListEntryOffset HexInt32 | — |
A19_AttrContextAttributeListAttributeListFormNonresidentValidDataLength HexInt64 | — |
A20_AttributeListGrowBy HexInt32 | — |
A21_AttributeListGrowBy Int32 | — |
Event ID 56 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Fcb Pointer | — |
A13_PULONGLONG_FcbFileReference HexInt64 | — |
A14_FrsConsolidationContextRestartAttributeTypeCode HexInt32 | — |
A15__FrsConsolidationContextRestartAttributeName CountedUtf16String | — |
A16_FrsConsolidationContextRestartVcn HexInt64 | — |
A17_FrsConsolidationContextInstance HexInt32 | — |
A18_FrsConsolidationContextRestartAttributeListEntryOffset HexInt32 | — |
A19_AttrContextAttributeListAttributeListFormNonresidentValidDataLength HexInt64 | — |
Event ID 57 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Fcb Pointer | — |
A13_PULONGLONG_FcbFileReference HexInt64 | — |
A14_FrsConsolidationContextRestartAttributeTypeCode HexInt32 | — |
A15__FrsConsolidationContextRestartAttributeName CountedUtf16String | — |
A16_FrsConsolidationContextRestartVcn HexInt64 | — |
A17_FrsConsolidationContextInstance HexInt32 | — |
A18_FrsConsolidationContextRestartAttributeListEntryOffset HexInt32 | — |
A19_AttrContextAttributeListAttributeListFormNonresidentValidDataLength HexInt64 | — |
Event ID 58 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Fcb Pointer | — |
A13_PULONGLONG_FcbFileReference HexInt64 | — |
A14_Scb Pointer | — |
Event ID 59 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Fcb Pointer | — |
A13_PULONGLONG_FcbFileReference HexInt64 | — |
Event ID 60 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_PULONGLONG_FrsConsolidationContextFileReference HexInt64 | — |
A13_IrpContextExceptionStatus HexInt32 | — |
Event ID 61 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Fcb Pointer | — |
A13_PULONGLONG_FcbFileReference HexInt64 | — |
Event ID 62 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Fcb Pointer | — |
A13_PULONGLONG_FcbFileReference HexInt64 | — |
Event ID 63 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Fcb Pointer | — |
A13_FileRef HexInt64 | — |
A14_ExceptionStatus HexInt32 | — |
Event ID 64 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Fcb Pointer | — |
A13_FileRef HexInt64 | — |
A14_RemovedFcb HexInt32 | — |
A15_AllFlagsFcbAcquired HexInt32 | — |
A16_IrpContextTransactionId HexInt32 | — |
Event ID 65 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_EndTimeQuadPart1000NtfsPerformanceFrequencyQuadPart Int64 | — |
A13_FrsConsolidationContextTotalTime1000NtfsPerformanceFrequencyQuadPart Int64 | — |
Event ID 66 —
Fields #
| Name | Description |
|---|---|
A10_FcbVcb Pointer | — |
A11_IrpContext Pointer | — |
A12_PULONGLONG_FcbFileReference HexInt64 | — |
A13_StdInfoAttrListEntrySignature HexInt32 | — |
A14_StdInfoAttrListEntryLastCompactedSize HexInt32 | — |
A15_AttributeListSize HexInt32 | — |
Event ID 67 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_Vcb Pointer | — |
A12_Scb Pointer | — |
A13__ScbMcb Pointer | — |
A14_OriginalStartingVcn HexInt64 | — |
A15_ClusterCount HexInt64 | — |
A16_AllocateAll UInt32 | — |
A17_TargetLcnNULLTargetLcnULONGLONG1 HexInt64 | — |
A18_PreAllocated UInt32 | — |
A19_UseDelayedAllocation UInt32 | — |
Event ID 68 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_Vcb Pointer | — |
A12_Scb Pointer | — |
A13__ScbMcb Pointer | — |
A14_OriginalStartingVcn HexInt64 | — |
A15_ClusterCount HexInt64 | — |
A16_AllocateAll UInt32 | — |
A17_TargetLcnNULLTargetLcnULONGLONG1 HexInt64 | — |
A18_PreAllocated UInt32 | — |
A19_UseDelayedAllocation UInt32 | — |
Event ID 69 —
Fields #
| Name | Description |
|---|---|
A10_FoundClusterCount HexInt64 | — |
A11_Scb Pointer | — |
A12_ScbTotalAllocated HexInt64 | — |
Event ID 70 —
Fields #
| Name | Description |
|---|---|
A10_FoundClusterCount HexInt64 | — |
A11_Scb Pointer | — |
A12_ScbTotalAllocated HexInt64 | — |
A13_ScbState HexInt32 | — |
A14_IrpContextState2 HexInt32 | — |
A15_AllocateWithNoHole Int32 | — |
Event ID 71 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_ClustersAllocated UInt32 | — |
Event ID 72 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_ClustersAllocated UInt32 | — |
Event ID 73 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_Vcb Pointer | — |
A12_Scb Pointer | — |
A13__ScbMcb Pointer | — |
A14_StartingVcn HexInt64 | — |
A15_EndingVcn HexInt64 | — |
Event ID 74 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_PULONGLONG_ScbFcbFileReference HexInt64 | — |
A12_StartingVcn HexInt64 | — |
A13_EndingVcn HexInt64 | — |
Event ID 75 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_Vcb Pointer | — |
A12_Scb Pointer | — |
A13__ScbMcb Pointer | — |
A14_StartingVcn HexInt64 | — |
A15_EndingVcn HexInt64 | — |
Event ID 76 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_PULONGLONG_ScbFcbFileReference HexInt64 | — |
A12_AdjLcn HexInt64 | — |
A13_AdjClusterCount HexInt64 | — |
Event ID 77 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 78 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_DeallocatedClusters Pointer | — |
A12_DeallocatedClustersLsnQuadPart HexInt64 | — |
A13_DeallocatedClustersClusterCount HexInt64 | — |
A14_DeallocatedClustersFlags HexInt32 | — |
A15_VcbDeallocatedClusters HexInt64 | — |
A16_VcbDeallocatedClustersAdjClusterCount HexInt64 | — |
Event ID 79 —
Fields #
| Name | Description |
|---|---|
A10_ClusterCount HexInt64 | — |
A11_Scb Pointer | — |
A12_TotalAllocated HexInt64 | — |
A13_TotalAllocated Pointer | — |
Event ID 80 —
Fields #
| Name | Description |
|---|---|
A10_ClusterCount HexInt64 | — |
A11_Scb Pointer | — |
A12_TotalAllocated Pointer | — |
A13_ScbState HexInt32 | — |
A14_IrpContextState2 HexInt32 | — |
Event ID 81 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_VcbDeallocatedClusters HexInt64 | — |
A12_VcbDeallocatedClustersClustersRemoved HexInt64 | — |
Event ID 82 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_ClustersDeallocated UInt32 | — |
Event ID 83 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_ClustersDeallocated UInt32 | — |
Event ID 84 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_Vcb Pointer | — |
A12_FirstBit HexInt64 | — |
A13_BeyondFinalBit HexInt64 | — |
A14_RedoOperation HexInt32 | — |
A15_UndoOperation HexInt32 | — |
Event ID 85 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11__Bitmap Pointer | — |
A12_BaseLcn HexInt64 | — |
A13_CurrentLcn HexInt64 | — |
Event ID 86 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_Vcb Pointer | — |
A12_StartingLcn HexInt64 | — |
A13_ClusterCount HexInt64 | — |
Event ID 87 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11__Bitmap Pointer | — |
A12_BaseLcn HexInt64 | — |
A13_StartingLcn HexInt64 | — |
Event ID 88 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_Bitmap Pointer | — |
A12_BitMapOffset HexInt32 | — |
A13_NumberOfBits HexInt32 | — |
Event ID 89 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_Vcb Pointer | — |
A12_StartingLcn HexInt64 | — |
A13_ClusterCount HexInt64 | — |
Event ID 90 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11__Bitmap Pointer | — |
A12_BaseLcn HexInt64 | — |
A13_StartingLcn HexInt64 | — |
Event ID 91 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_Bitmap Pointer | — |
A12_BitMapOffset HexInt32 | — |
A13_NumberOfBits HexInt32 | — |
Event ID 92 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_Vcb Pointer | — |
A12_Bitmap Pointer | — |
A13_StartingBitmapLcn HexInt64 | — |
A14_SetBits UInt32 | — |
Event ID 93 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_Bitmap Pointer | — |
A12_StartingBit HexInt64 | — |
A13_EndingBit HexInt64 | — |
Event ID 94 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_Results UInt32 | — |
Event ID 95 —
Fields #
| Name | Description |
|---|---|
A10_i HexInt32 | — |
A11_OriginalSystemBitmapisizeofOriginalSystemBitmap0 HexInt32 | — |
Event ID 96 —
Event ID 97 —
Fields #
| Name | Description |
|---|---|
A10_Length Int64 | — |
A11_BinIndex UInt32 | — |
A12_Key UInt32 | — |
A13_BitPosition Int32 | — |
A14_GroupIndex Int32 | — |
A15_GroupShiftFactor Int32 | — |
Event ID 98 —
Fields #
| Name | Description |
|---|---|
A10_Length Int64 | — |
A11_BinIndex UInt32 | — |
A12_TotalBins UInt32 | — |
Event ID 99 —
Fields #
| Name | Description |
|---|---|
A10_BinIndex UInt32 | — |
A11_MAXLONGLONG Int64 | — |
A12_TotalBins UInt32 | — |
Event ID 100 —
Fields #
| Name | Description |
|---|---|
A10_BinIndex UInt32 | — |
A11_MaxLength Int64 | — |
A12_GroupIndex Int32 | — |
A13_RelativeBinIndex Int32 | — |
A14_MaxKey UInt32 | — |
Event ID 101 —
Fields #
| Name | Description |
|---|---|
A10_NtfsCachedRunBinGroupShift Int32 | — |
A11_NtfsCachedRunBinGroupSize UInt32 | — |
A12_NtfsCachedRunBinGroupMask HexInt32 | — |
Event ID 102 —
Fields #
| Name | Description |
|---|---|
A10_BinIndex UInt32 | — |
A11_MaxLength UInt64 | — |
A12_MaxLength HexInt64 | — |
Event ID 103 —
Fields #
| Name | Description |
|---|---|
A10_StartingCluster HexInt64 | — |
A11_ClusterCount HexInt64 | — |
A12_VcbTotalClustersCommitted HexInt64 | — |
A13_VcbTotalClusters HexInt64 | — |
A14_VcbFreeClusters HexInt64 | — |
Event ID 104 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_FirstBitToClear HexInt32 | — |
A12_BeyondLastBitToClear1 HexInt32 | — |
Event ID 105 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 106 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_FreeClusterBase1 HexInt64 | — |
A12_FreeClusterCount1 HexInt64 | — |
Event ID 107 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 108 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_FreeClusterBase2 HexInt64 | — |
A12_FreeClusterCount2 HexInt64 | — |
Event ID 109 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_PsGetCurrentThread Pointer | — |
A12_VcbTotalClustersCommitted HexInt64 | — |
A13_VcbTotalClusters HexInt64 | — |
A14_VcbTPMapSizeOfBitMap HexInt32 | — |
Event ID 110 —
Fields #
| Name | Description |
|---|---|
A10_IrpContextMajorFunction UInt32 | — |
Event ID 111 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11_StartingZero HexInt64 | — |
A12_ByteCount HexInt64 | — |
A13_ExtentsDescriptor Pointer | — |
A14_ExtentsDescriptorIndex Int32 | — |
A15_ExtentsDescriptorStartOffset HexInt64 | — |
A16_Offset HexInt64 | — |
A17_MaxRuns Int32 | — |
Event ID 112 —
Fields #
| Name | Description |
|---|---|
A10_RunIndex Int32 | — |
A11_ExtentsDescriptorRunRunIndexBasePage HexInt64 | — |
A12_ExtentsDescriptorRunRunIndexPageCount HexInt64 | — |
A13_ExtentLength HexInt64 | — |
A14_Offset HexInt64 | — |
A15_RunIndexStartOffset HexInt64 | — |
Event ID 113 —
Event ID 114 —
Fields #
| Name | Description |
|---|---|
A10_LengthInExtent HexInt64 | — |
A11_ByteCount HexInt64 | — |
Event ID 115 —
Fields #
| Name | Description |
|---|---|
A10_StartingPhysicalAddrQuadPart HexInt64 | — |
A11_LengthInExtent HexInt64 | — |
Event ID 116 —
Fields #
| Name | Description |
|---|---|
A10_ExtentsDescriptorIndex Int32 | — |
A11_ExtentsDescriptorStartOffset HexInt64 | — |
Event ID 117 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11_StartingOffset HexInt64 | — |
A12_BeyondEndOffset HexInt64 | — |
Event ID 118 —
Fields #
| Name | Description |
|---|---|
A10_DataSetRangeIndex Int32 | — |
A11_DsmBufferDataSetRangesDataSetRangeIndexStartingOffset HexInt64 | — |
A12_DsmBufferDataSetRangesDataSetRangeIndexLengthInBytes HexInt64 | — |
Event ID 119 —
Fields #
| Name | Description |
|---|---|
A10_RemainingClusterCount HexInt64 | — |
A11_DataSetRangeIndex Int32 | — |
Event ID 120 —
Fields #
| Name | Description |
|---|---|
A10_DsmByteAddressRangesTotalNumberOfRanges Int32 | — |
A11_DsmByteAddressRangesNumberOfRangesReturned Int32 | — |
Event ID 121 —
Fields #
| Name | Description |
|---|---|
A10_Index Int32 | — |
A11_DsmByteAddressRangesRangesIndexStartAddress HexInt64 | — |
A12_DsmByteAddressRangesRangesIndexLengthInBytes HexInt64 | — |
Event ID 122 —
Fields #
| Name | Description |
|---|---|
A10_StartingPhysicalAddrQuadPart HexInt64 | — |
A11_LengthInExtent HexInt64 | — |
Event ID 123 —
Fields #
| Name | Description |
|---|---|
A10_ExtentsDescriptorIndex Int32 | — |
A11_ExtentsDescriptorStartOffset HexInt64 | — |
Event ID 124 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11_StartingZero HexInt64 | — |
A12_BeyondEndOffset HexInt64 | — |
A13_ByteCount HexInt64 | — |
A14_ExtentsDescriptor Pointer | — |
A15_ExtentsDescriptorIndexExtentsDescriptorIndex0 Int32 | — |
A16_ExtentsDescriptorStartOffsetExtentsDescriptorStartOffset0 HexInt64 | — |
Event ID 125 —
Fields #
| Name | Description |
|---|---|
A10_ExtentsDescriptorIndex Int32 | — |
A11_ExtentsDescriptorStartOffset HexInt64 | — |
Event ID 126 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_Scb Pointer | — |
A12_StartOffset HexInt64 | — |
A13_ByteCount HexInt32 | — |
Event ID 127 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
Event ID 128 —
Fields #
| Name | Description |
|---|---|
A10_TypeOfOpen UInt32 | — |
Event ID 129 —
Fields #
| Name | Description |
|---|---|
A10_Status HexInt32 | — |
Event ID 130 —
Fields #
| Name | Description |
|---|---|
A10_Status HexInt32 | — |
Event ID 131 —
Fields #
| Name | Description |
|---|---|
A10_Status HexInt32 | — |
Event ID 132 —
Fields #
| Name | Description |
|---|---|
A10_Irp Pointer | — |
A11_IrpContext Pointer | — |
A12_Vcb Pointer | — |
A13_CreateContextFileObject Pointer | — |
A14_CreateContextFileObjectRelatedFileObject Pointer | — |
A15__CreateContextFileObjectFileName 25 | — |
A16_CreateContextIrpSpParametersCreateOptions HexInt32 | — |
A17_CreateContextIrpSpParametersCreateFileAttributes HexInt32 | — |
A18_CreateContextDesiredAccess HexInt32 | — |
A19_CreateContextIrpSpParametersCreateShareAccess HexInt32 | — |
A20_CreateContextIrpSpParametersCreateEaLength HexInt32 | — |
Event ID 133 —
Fields #
| Name | Description |
|---|---|
A10_Irp Pointer | — |
A11_IrpContext Pointer | — |
A12_Vcb Pointer | — |
A13_CreateContextFileObject Pointer | — |
A14_CreateContextFileObjectRelatedFileObject Pointer | — |
A15__CreateContextFileObjectFileName CountedUtf16String | — |
A16_CreateContextIrpSpParametersCreateOptions HexInt32 | — |
A17_CreateContextIrpSpParametersCreateFileAttributes HexInt32 | — |
A18_CreateContextDesiredAccess HexInt32 | — |
A19_CreateContextIrpSpParametersCreateShareAccess HexInt32 | — |
A20_CreateContextIrpSpParametersCreateEaLength HexInt32 | — |
Event ID 134 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_VcbVcbState HexInt32 | — |
Event ID 135 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_CreateDisposition HexInt32 | — |
Event ID 136 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_VcbVcbState HexInt32 | — |
Event ID 137 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_IrpSpParametersCreateShareAccess HexInt32 | — |
A15_ReadULongNoFence_VcbCleanupCount Int32 | — |
A16_BiasedCleanupCount Int32 | — |
Event ID 138 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_VcbVcbState HexInt32 | — |
Event ID 139 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_IrpSpParametersCreateShareAccess HexInt32 | — |
A15_VcbReadOnlyCloseCount Int32 | — |
A16_VcbCloseCount Int32 | — |
A17_VcbSystemFileCloseCount Int32 | — |
Event ID 140 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_FcbVcb Pointer | — |
A12__FcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | — |
A14_Fcb Pointer | — |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | — |
A16_FcbCleanupCount Int32 | — |
A17_FcbFcbState HexInt32 | — |
A18_IrpSpFlags HexInt32 | — |
Event ID 141 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_FcbVcb Pointer | — |
A12__FcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | — |
A14_Fcb Pointer | — |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | — |
A16_FcbFcbState HexInt32 | — |
A17_IrpSpFlags HexInt32 | — |
Event ID 142 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_FcbVcb Pointer | — |
A12__FcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | — |
A14_Fcb Pointer | — |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | — |
A16_IrpContextState HexInt32 | — |
A17_IrpSpFlags HexInt32 | — |
Event ID 143 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ThisFcbVcb Pointer | — |
A12__ThisFcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | — |
A14_ThisFcb Pointer | — |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | — |
A16_ThisFcbFcbState HexInt32 | — |
A17_CreateContextIrpSpParametersCreateOptions24_0x000000ff HexInt32 | — |
A18_CreateContextIrpSpParametersCreateSecurityContextDesiredAccess HexInt32 | — |
Event ID 144 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_CreateContextCurrentFcbVcb Pointer | — |
A12__CreateContextCurrentFcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWCreateContextCurrentFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHCreateContextCurrentFcbVcbVpb CountedUtf16String | — |
A14_CreateContextCurrentFcb Pointer | — |
A15_NtfsFullFileRefNumber_CreateContextCurrentFcbFileReference HexInt64 | — |
A16_CreateContextCurrentFcbInfoFileAttributes HexInt32 | — |
A17_CreateContextCurrentFcbTxfRmcbRmState HexInt32 | — |
Event ID 145 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_CreateContextCurrentFcbVcb Pointer | — |
A12__CreateContextCurrentFcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWCreateContextCurrentFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHCreateContextCurrentFcbVcbVpb CountedUtf16String | — |
A14_CreateContextCurrentFcb Pointer | — |
A15_NtfsFullFileRefNumber_CreateContextCurrentFcbFileReference HexInt64 | — |
A16_CreateContextCurrentFcbFcbState HexInt32 | — |
A17_CreateContextIrpSpParametersCreateOptions24_0x000000ff HexInt32 | — |
A18_CreateContextIrpSpParametersCreateSecurityContextDesiredAccess HexInt32 | — |
Event ID 146 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ThisFcbVcb Pointer | — |
A12__ThisFcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | — |
A14_ThisFcb Pointer | — |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | — |
A16_ThisFcbFcbState HexInt32 | — |
Event ID 147 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ThisFcbVcb Pointer | — |
A12__ThisFcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | — |
A14_ThisFcb Pointer | — |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | — |
A16_ThisFcbFcbState HexInt32 | — |
A17_CreateContextIrpSpParametersCreateOptions24_0x000000ff HexInt32 | — |
A18_CreateContextIrpSpParametersCreateSecurityContextDesiredAccess HexInt32 | — |
Event ID 148 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ThisFcbVcb Pointer | — |
A12__ThisFcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | — |
A14_ThisFcb Pointer | — |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | — |
A16_ThisFcbTxfRmcbRmState HexInt32 | — |
Event ID 149 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ParentScbFcbVcb Pointer | — |
A12__ParentScbFcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWParentScbFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHParentScbFcbVcbVpb CountedUtf16String | — |
A14_ParentScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ParentScbFcbFileReference HexInt64 | — |
A16_ParentScbFcbFcbState HexInt32 | — |
A17_ParentScbFcbTxfRmcbRmState HexInt32 | — |
A18_AttrTypeCode HexInt32 | — |
Event ID 150 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__ThisFcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | — |
A14_ThisFcb Pointer | — |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | — |
A16_CreateContextIrpSpParametersCreateOptions HexInt32 | — |
A17_CcbFlags HexInt32 | — |
Event ID 151 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ParentScbVcb Pointer | — |
A12__ParentScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWParentScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHParentScbVcbVpb CountedUtf16String | — |
A14_ParentScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ParentScbFcbFileReference HexInt64 | — |
A16_ParentScbFcbFcbState HexInt32 | — |
A17_ParentScbFcbTxfRmcbRmState HexInt32 | — |
Event ID 152 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_ThisFcb Pointer | — |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | — |
A16_ThisFcbTxfRmcbRmState HexInt32 | — |
Event ID 153 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ThisFcbVcb Pointer | — |
A12__ThisFcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | — |
A14_ThisFcb Pointer | — |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | — |
A16_ThisEaInformationNeedEaCount Int32 | — |
A17_CreateContextIrpSpParametersCreateOptions HexInt32 | — |
A18_CcbFlags HexInt32 | — |
Event ID 154 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ThisFcbVcb Pointer | — |
A12__ThisFcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | — |
A14_ThisFcb Pointer | — |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | — |
A16_AttrTypeCode HexInt32 | — |
A17_CreateDisposition HexInt32 | — |
Event ID 155 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ThisFcbVcb Pointer | — |
A12__ThisFcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | — |
A14_ThisFcb Pointer | — |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | — |
A16_CreateDisposition HexInt32 | — |
Event ID 156 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ThisFcbVcb Pointer | — |
A12__ThisFcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | — |
A14_ThisFcb Pointer | — |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | — |
A16_ThisFcbFcbState HexInt32 | — |
A17_AttrTypeCode HexInt32 | — |
Event ID 157 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ThisFcbVcb Pointer | — |
A12__ThisFcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | — |
A14_ThisFcb Pointer | — |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | — |
A16_ThisFcbInfoFileAttributes HexInt32 | — |
A17_FileAttributes HexInt32 | — |
Event ID 158 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ThisFcbVcb Pointer | — |
A12__ThisFcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | — |
A14_ThisFcb Pointer | — |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | — |
A16_CreateContextIrpSpParametersCreateOptions HexInt32 | — |
Event ID 159 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ThisFcbVcb Pointer | — |
A12__ThisFcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | — |
A14_ThisFcb Pointer | — |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | — |
A16_CreateContextThisScbAttributeTypeCode HexInt32 | — |
A17_CreateContextThisScbState HexInt32 | — |
A18_CreateContextThisScbScbTypeDataHighWaterMark Int64 | — |
Event ID 160 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_AttrCode HexInt32 | — |
A15_CreateDisposition HexInt32 | — |
Event ID 161 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_AttrCode HexInt32 | — |
A15_IrpSpParametersCreateSecurityContextAccessStateOriginalDesiredAccess HexInt32 | — |
Event ID 162 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_AttrCode HexInt32 | — |
Event ID 163 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ThisScbVcb Pointer | — |
A12__ThisScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWThisScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisScbVcbVpb CountedUtf16String | — |
A14_ThisScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ThisScbFcbFileReference HexInt64 | — |
A16_ThisScb Pointer | — |
A17_ThisScbAttributeTypeCode HexInt32 | — |
A18__ThisScbAttributeName CountedUtf16String | — |
A19_IrpSpParametersCreateShareAccess HexInt32 | — |
A20_IrpSpParametersCreateSecurityContextAccessStatePreviouslyGrantedAccess HexInt32 | — |
Event ID 164 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ThisScbVcb Pointer | — |
A12__ThisScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWThisScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisScbVcbVpb CountedUtf16String | — |
A14_ThisScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ThisScbFcbFileReference HexInt64 | — |
A16_ThisScb Pointer | — |
A17_ThisScbAttributeTypeCode HexInt32 | — |
A18__ThisScbAttributeName CountedUtf16String | — |
Event ID 165 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ThisScbVcb Pointer | — |
A12__ThisScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWThisScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisScbVcbVpb CountedUtf16String | — |
A14_ThisScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ThisScbFcbFileReference HexInt64 | — |
A16_ThisScb Pointer | — |
A17_ThisScbAttributeTypeCode HexInt32 | — |
A18__ThisScbAttributeName CountedUtf16String | — |
A19_IrpSpParametersCreateSecurityContextAccessStatePreviouslyGrantedAccess HexInt32 | — |
Event ID 166 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ThisScbVcb Pointer | — |
A12__ThisScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWThisScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisScbVcbVpb CountedUtf16String | — |
A14_ThisScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ThisScbFcbFileReference HexInt64 | — |
A16_ThisScb Pointer | — |
A17_ThisScbMarkHandleDisallowWritesCount Int32 | — |
A18_IrpSpParametersCreateSecurityContextDesiredAccess HexInt32 | — |
Event ID 167 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ThisScbVcb Pointer | — |
A12__ThisScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWThisScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisScbVcbVpb CountedUtf16String | — |
A14_ThisScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ThisScbFcbFileReference HexInt64 | — |
A16_ThisScb Pointer | — |
A17_ThisScbAttributeTypeCode HexInt32 | — |
A18__ThisScbAttributeName CountedUtf16String | — |
A19_IrpSpParametersCreateShareAccess HexInt32 | — |
A20_GrantedAccess HexInt32 | — |
Event ID 168 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ThisScbVcb Pointer | — |
A12__ThisScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWThisScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisScbVcbVpb CountedUtf16String | — |
A14_ThisScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ThisScbFcbFileReference HexInt64 | — |
A16_IrpSpParametersCreateShareAccess HexInt32 | — |
A17_IrpSpFileObjectFlags HexInt32 | — |
Event ID 169 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ThisScbVcb Pointer | — |
A12__ThisScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWThisScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisScbVcbVpb CountedUtf16String | — |
A14_ThisScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ThisScbFcbFileReference HexInt64 | — |
A16_ThisScb Pointer | — |
A17_ThisScbAttributeTypeCode HexInt32 | — |
A18__ThisScbAttributeName CountedUtf16String | — |
A19_IrpSpParametersCreateShareAccess HexInt32 | — |
A20_GrantedAccess HexInt32 | — |
Event ID 170 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ThisFcbVcb Pointer | — |
A12__ThisFcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | — |
A14_ThisFcb Pointer | — |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | — |
A16_IrpSpParametersCreateShareAccess HexInt32 | — |
A17_IrpSpFileObjectFlags HexInt32 | — |
Event ID 171 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ThisFcbVcb Pointer | — |
A12__ThisFcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | — |
A14_ThisFcb Pointer | — |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | — |
A16_IrpSpParametersCreateSecurityContextDesiredAccess HexInt32 | — |
A17_ThisFcbInfoFileAttributes HexInt32 | — |
A18_IrpSpFlags HexInt32 | — |
Event ID 172 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_CurrentFcbVcb Pointer | — |
A12__CurrentFcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWCurrentFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHCurrentFcbVcbVpb CountedUtf16String | — |
A14_CurrentFcb Pointer | — |
A15_NtfsFullFileRefNumber_CurrentFcbFileReference HexInt64 | — |
A16_CurrentFcbInfoFileAttributes HexInt32 | — |
A17_NtfsDataFlags HexInt32 | — |
Event ID 173 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_CurrentFcbVcb Pointer | — |
A12__CurrentFcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWCurrentFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHCurrentFcbVcbVpb CountedUtf16String | — |
A14_CurrentFcb Pointer | — |
A15_NtfsFullFileRefNumber_CurrentFcbFileReference HexInt64 | — |
A16_CurrentFcbInfoFileAttributes HexInt32 | — |
A17_ThisScbAttributeFlags HexInt32 | — |
Event ID 174 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ThisScbVcb Pointer | — |
A12__ThisScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWThisScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisScbVcbVpb CountedUtf16String | — |
A14_ThisScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ThisScbFcbFileReference HexInt64 | — |
A16_CreateContextCurrentFcbCleanupCount Int32 | — |
A17_NtfsDataEncryptionCallBackTableImplementationFlags HexInt32 | — |
Event ID 175 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_CurrentFcb Pointer | — |
A12_NtfsFullFileRefNumber_CurrentFcbFileReference HexInt64 | — |
A13_CurrentFcbTxfRmcbRmState HexInt32 | — |
Event ID 176 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_LcbFcbVcb Pointer | — |
A12__LcbFcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWLcbFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHLcbFcbVcbVpb CountedUtf16String | — |
A14_LcbFcb Pointer | — |
A15_NtfsFullFileRefNumber_LcbFcbFileReference HexInt64 | — |
A16_WppCountedStringWLcbFileNameAttrFileNameUSHORTLcbFileNameAttrFileNameLength CountedUtf16String | — |
A17_DesiredAccess HexInt32 | — |
A18_DesiredShareAccess HexInt32 | — |
A19_IoShareAccessFlags HexInt32 | — |
A20_LinkShareAccessOpenCount Int32 | — |
A21_LinkShareAccessDeleters Int32 | — |
A22_LinkShareAccessSharedDelete Int32 | — |
Event ID 177 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ScbVcb Pointer | — |
A12__ScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16_ScbAttributeTypeCode HexInt32 | — |
A17__ScbAttributeName CountedUtf16String | — |
A18_DesiredAccess HexInt32 | — |
A19_DesiredShareAccess HexInt32 | — |
A20_IoShareAccessFlags HexInt32 | — |
A21_ShareAccessOpenCount Int32 | — |
A22_ShareAccessReaders Int32 | — |
A23_ShareAccessWriters Int32 | — |
A24_ShareAccessDeleters Int32 | — |
A25_ShareAccessSharedRead Int32 | — |
A26_ShareAccessSharedWrite Int32 | — |
A27_ShareAccessSharedDelete Int32 | — |
Event ID 178 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ScbVcb Pointer | — |
A12__ScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16_ScbAttributeTypeCode HexInt32 | — |
A17__ScbAttributeName CountedUtf16String | — |
A18_WppCountedStringWLcbFileNameAttrFileNameUSHORTLcbFileNameAttrFileNameLength CountedUtf16String | — |
A19_DesiredAccess HexInt32 | — |
A20_DesiredShareAccess HexInt32 | — |
A21_IoShareAccessFlags HexInt32 | — |
A22_ShareAccessOpenCount Int32 | — |
A23_ShareAccessReaders Int32 | — |
A24_ShareAccessWriters Int32 | — |
A25_ShareAccessDeleters Int32 | — |
A26_ShareAccessSharedRead Int32 | — |
A27_ShareAccessSharedWrite Int32 | — |
A28_ShareAccessSharedDelete Int32 | — |
A29_LinkShareAccessOpenCount Int32 | — |
A30_LinkShareAccessDeleters Int32 | — |
A31_LinkShareAccessSharedDelete Int32 | — |
Event ID 179 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ScbVcb Pointer | — |
A12__ScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16_ScbAttributeTypeCode HexInt32 | — |
A17__ScbAttributeName CountedUtf16String | — |
A18_ARGUMENT_PRESENTLcbWppCountedStringWLcbFileNameAttrFileNameUSHORTLcbFileNameAttrFileNameLengthWppCountedStringWNULL0 CountedUtf16String | — |
A19_AccessStatePreviouslyGrantedAccess HexInt32 | — |
A20_AccessStateFlags HexInt32 | — |
A21_DesiredShareAccess HexInt32 | — |
A22_CreateDisposition HexInt32 | — |
A23_ScbShareAccessOpenCount Int32 | — |
A24_ScbShareAccessReaders Int32 | — |
A25_ScbShareAccessWriters Int32 | — |
A26_ScbShareAccessDeleters Int32 | — |
A27_ScbShareAccessSharedRead Int32 | — |
A28_ARGUMENT_PRESENTLcbLcbLinkShareAccessDeleters0 Int32 | — |
Event ID 180 —
Fields #
| Name | Description |
|---|---|
A10_FILEID_FROM_SOURCEFileNLine UInt32 | — |
A11_LINENUM_FROM_SOURCEFileNLine Int32 | — |
A12_Status HexInt32 | — |
A13__ProcessName CountedMbcsString | — |
Event ID 181 —
Fields #
| Name | Description |
|---|---|
A10_FILEID_FROM_SOURCEFileNLine UInt32 | — |
A11_LINENUM_FROM_SOURCEFileNLine Int32 | — |
A12_Status HexInt32 | — |
A13__ProcessName CountedMbcsString | — |
Event ID 182 —
Fields #
| Name | Description |
|---|---|
A10_FILEID_FROM_SOURCEFileNLine UInt32 | — |
A11_LINENUM_FROM_SOURCEFileNLine Int32 | — |
A12_Status HexInt32 | — |
A13__ProcessName CountedMbcsString | — |
Event ID 183 —
Fields #
| Name | Description |
|---|---|
A10_FILEID_FROM_SOURCEFileNLine UInt32 | — |
A11_LINENUM_FROM_SOURCEFileNLine Int32 | — |
A12_Status HexInt32 | — |
A13__ProcessName CountedMbcsString | — |
Event ID 184 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_StartingCluster HexInt64 | — |
A12_RunLength HexInt32 | — |
Event ID 185 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 186 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_MarkUnusedContext Pointer | — |
A12_MarkUnusedContextDeallocatedClusters Pointer | — |
A13__MarkUnusedContextDeallocatedClustersMcb Pointer | — |
Event ID 187 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_StartingCluster HexInt64 | — |
A12_RunLength HexInt32 | — |
A13__MarkUnusedContextDeallocatedClustersMcb Pointer | — |
Event ID 188 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11__MarkUnusedContextDeallocatedClustersMcb Pointer | — |
Event ID 189 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_MarkUnusedContext Pointer | — |
A12_IrpContext Pointer | — |
Event ID 190 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 191 —
Fields #
| Name | Description |
|---|---|
A10_Src Pointer | — |
A11_Dst Pointer | — |
A12_SrcClustersCount HexInt64 | — |
A13_SrcDeallocatedClustersClusterCount HexInt64 | — |
A14_SrcDsmAttrDataSetRangesLength HexInt32 | — |
Event ID 192 —
Fields #
| Name | Description |
|---|---|
A10_Src Pointer | — |
A11_Dst Pointer | — |
A12_SrcClustersCount HexInt64 | — |
A13_DstClustersCount HexInt64 | — |
A14_DstDsmAttrDataSetRangesLength HexInt32 | — |
A15_DstFirstDataSetRangePtrLengthInBytes HexInt64 | — |
A16_DstFirstDataSetRangePtrStartingOffset HexInt64 | — |
Event ID 193 —
Event ID 194 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_MarkUnusedContext Pointer | — |
A12_VcbDeallocatedClusters HexInt64 | — |
A13_VcbDeallocatedClustersListLengthInTrim HexInt32 | — |
A14_VcbDeallocatedClustersListLengthToDrain HexInt32 | — |
A15_ClustersClusterCount HexInt64 | — |
A16_InitialRanges HexInt32 | — |
Event ID 195 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_MarkUnusedContext Pointer | — |
A12_StartingLcn HexInt64 | — |
A13_ClusterCount HexInt64 | — |
A14_FreeClusterBase1 HexInt64 | — |
A15_FreeClusterCount1 HexInt64 | — |
A16_FreeClusterBase2 HexInt64 | — |
A17_FreeClusterCount2 HexInt64 | — |
Event ID 196 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 197 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_VcbCloseCount HexInt32 | — |
Event ID 198 —
Event ID 199 —
Fields #
| Name | Description |
|---|---|
A10_Irp Pointer | — |
Event ID 200 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
Event ID 201 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 202 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 203 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 204 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_SmallMarkUnusedContext Pointer | — |
A12_MarkUnusedContext Pointer | — |
Event ID 205 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_MarkUnusedContext Pointer | — |
Event ID 206 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_MarkUnusedContext Pointer | — |
Event ID 207 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_MarkUnusedContext Pointer | — |
A12_TrimEntryCount HexInt32 | — |
A13_DataSetRangePtrStartingOffset HexInt64 | — |
A14_DataSetRangePtrLengthInBytes HexInt64 | — |
Event ID 208 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_MarkUnusedContext Pointer | — |
A12_IrpUsed Pointer | — |
Event ID 209 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_MarkUnusedContext Pointer | — |
A12_Status HexInt32 | — |
Event ID 210 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_MarkUnusedContext Pointer | — |
Event ID 211 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_MarkUnusedContext Pointer | — |
Event ID 212 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_Status HexInt32 | — |
A12_MarkUnusedContext Pointer | — |
A13_MarkUnusedContextNULL__MarkUnusedContextDeallocatedClustersNULLMarkUnusedContextDeallocatedClustersClusterCount1LL HexInt64 | — |
Event ID 213 —
Event ID 214 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_DeallocatedClusters Pointer | — |
Event ID 215 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_DeallocatedClusters Pointer | — |
Event ID 216 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_DeallocatedClusters Pointer | — |
Event ID 217 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_All HexInt32 | — |
Event ID 218 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 219 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 220 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 221 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 222 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_DeallocatedClustersToWaitForDeallocatedClusters Pointer | — |
Event ID 223 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 224 —
Fields #
| Name | Description |
|---|---|
A10_IrpContextVcb Pointer | — |
A11_DeallocatedClustersToWaitForDeallocatedClusters Pointer | — |
Event ID 225 —
Fields #
| Name | Description |
|---|---|
A10_WaitInSeconds Int32 | — |
A11_CurrentTimeQuadPartDeallocatedClustersToWaitForEndTimeQuadPartULONGCurrentTimeQuadPartDeallocatedClustersToWaitForEndTimeQuadPartNtfsDataSystemTimeIncrementINTERVAL_ONE_SECOND0 Int32 | — |
A12_IrpContext Pointer | — |
A13_IrpContextVcb Pointer | — |
A14_DeallocatedClusters Pointer | — |
Event ID 226 —
Fields #
| Name | Description |
|---|---|
A10_WaitInSeconds Int32 | — |
A11_CurrentTimeQuadPartDeallocatedClustersToWaitForEndTimeQuadPartULONGCurrentTimeQuadPartDeallocatedClustersToWaitForEndTimeQuadPartNtfsDataSystemTimeIncrementINTERVAL_ONE_SECOND0 Int32 | — |
A12_IrpContext Pointer | — |
A13_IrpContextVcb Pointer | — |
A14_DeallocatedClusters Pointer | — |
Event ID 227 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_VcbDeallocatedClustersListLengthInTrim Int32 | — |
Event ID 228 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 229 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 230 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_AcquiredVcb UInt32 | — |
Event ID 231 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_MarkUnusedContext Pointer | — |
Event ID 232 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_MarkUnusedContext Pointer | — |
A12_RunIndex UInt32 | — |
A13_StartingOffset HexInt64 | — |
A14_LengthInBytes HexInt64 | — |
Event ID 233 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_MarkUnusedContext Pointer | — |
A12_DataSetRangeCount UInt32 | — |
A13_McbRunCount UInt32 | — |
A14_SmartTrimFreeRangeCount UInt32 | — |
Event ID 234 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_MarkUnusedContext Pointer | — |
A12_RunIndex UInt32 | — |
A13_DataSetRangeStartingOffset HexInt64 | — |
A14_DataSetRangeLengthInBytes HexInt64 | — |
Event ID 235 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_StartingLcn HexInt64 | — |
A12_ClusterCount HexInt64 | — |
A13_FirstTpMapBit HexInt32 | — |
A14_LastTpMapBit HexInt32 | — |
Event ID 236 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_SmartTrimStateSlabRangesCount UInt32 | — |
Event ID 237 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_SlabRangeIndex UInt32 | — |
A12_SlabRangeFirstTPMapBit HexInt32 | — |
A13_SlabRangeLastTPMapBit HexInt32 | — |
Event ID 238 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 239 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 240 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 241 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_AcquiredBitmap UInt32 | — |
Event ID 242 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_TpMapBit HexInt32 | — |
Event ID 243 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_TpMapBit HexInt32 | — |
Event ID 244 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_TpMapBit HexInt32 | — |
A12_SlabBaseLcn HexInt64 | — |
A13_SlabLengthInClusters HexInt64 | — |
Event ID 245 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 246 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 247 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 248 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_VcbVcbState HexInt32 | — |
A15_IrpSpFlags HexInt32 | — |
Event ID 249 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_Status HexInt32 | — |
Event ID 250 —
Event ID 251 —
Event ID 252 —
Event ID 253 —
Fields #
| Name | Description |
|---|---|
A10_ScbVcb Pointer | — |
A11_StartingVbo HexInt64 | — |
A12_ByteCount HexInt32 | — |
Event ID 254 —
Fields #
| Name | Description |
|---|---|
A10_FileObject Pointer | — |
Event ID 255 —
Fields #
| Name | Description |
|---|---|
A10_ULONGBadVcn HexInt32 | — |
A11_PLARGE_INTEGER_BadVcnHighPart HexInt32 | — |
Event ID 256 —
Fields #
| Name | Description |
|---|---|
A10_ULONGBadLcn HexInt32 | — |
A11_PLARGE_INTEGER_BadLcnHighPart HexInt32 | — |
Event ID 257 —
Event ID 258 —
Event ID 259 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_Vcb Pointer | — |
A12_NewBufferSize HexInt32 | — |
Event ID 260 —
Fields #
| Name | Description |
|---|---|
A10_NewBufferSize HexInt32 | — |
A11_NtfsGetCompressionBufferSize HexInt32 | — |
Event ID 261 —
Fields #
| Name | Description |
|---|---|
A10_Status HexInt32 | — |
Event ID 262 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_Vcb Pointer | — |
A12_NewBufferSize HexInt32 | — |
Event ID 263 —
Fields #
| Name | Description |
|---|---|
A10_NewBufferSize HexInt32 | — |
A11_NtfsGetUsaBufferSizeVcb HexInt32 | — |
Event ID 264 —
Fields #
| Name | Description |
|---|---|
A10_Status HexInt32 | — |
Event ID 265 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ScbVcb Pointer | — |
A12__ScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16_Scb Pointer | — |
A17_ScbAttributeTypeCode HexInt32 | — |
A18__ScbAttributeName CountedUtf16String | — |
A19_ScbPersist HexInt32 | — |
A20_CcbFlags HexInt32 | — |
Event ID 266 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 267 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 268 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ScbVcb Pointer | — |
A12__ScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16_Scb Pointer | — |
A17_ScbAttributeTypeCode HexInt32 | — |
A18__ScbAttributeName CountedUtf16String | — |
A19_ScbPersist HexInt32 | — |
A20_CcbFlags HexInt32 | — |
Event ID 269 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Scb Pointer | — |
A13_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A14_MoveDataStartingVcnQuadPart HexInt64 | — |
A15_TransferClusters HexInt64 | — |
A16_Lcn HexInt64 | — |
A17_MoveDataStartingLcnQuadPart HexInt64 | — |
A18_CopyLength HexInt32 | — |
A19_FlagsUseDelayedAllocation Int32 | — |
A20_Status HexInt32 | — |
Event ID 270 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Scb Pointer | — |
A13_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A14_MoveDataStartingVcnQuadPart HexInt64 | — |
A15_TransferClusters HexInt64 | — |
A16_Lcn HexInt64 | — |
A17_MoveDataStartingLcnQuadPart HexInt64 | — |
A18_CopyLength HexInt32 | — |
A19_FlagsUseDelayedAllocation Int32 | — |
A20_MyStatus HexInt32 | — |
Event ID 271 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Scb Pointer | — |
A13_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A14_Lcn HexInt64 | — |
A15_CopyLength HexInt32 | — |
A16_MyStatus HexInt32 | — |
Event ID 272 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Scb Pointer | — |
A13_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A14_MoveDataStartingLcnQuadPart HexInt64 | — |
A15_CopyLength HexInt32 | — |
A16_MyStatus HexInt32 | — |
Event ID 273 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Scb Pointer | — |
A13_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A14_MoveDataStartingVcnQuadPart HexInt64 | — |
A15_TransferClusters HexInt64 | — |
A16_Lcn HexInt64 | — |
A17_MoveDataStartingLcnQuadPart HexInt64 | — |
A18_FlagsUseDelayedAllocation Int32 | — |
A19_ValidClusters HexInt64 | — |
Event ID 274 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Scb Pointer | — |
A13_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A14_MoveDataStartingVcnQuadPart HexInt64 | — |
A15_TransferClusters HexInt64 | — |
Event ID 275 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_FcbVcb Pointer | — |
A12__FcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | — |
A14_Fcb Pointer | — |
A15_FcbNULLNtfsFullFileRefNumber_FcbFileReference0 HexInt64 | — |
A16_CcbNULLCcbFlags0 HexInt32 | — |
Event ID 276 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ScbVcb Pointer | — |
A12__ScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16_Scb Pointer | — |
A17_ScbAttributeTypeCode HexInt32 | — |
A18_ScbAttributeNameBuffer UnicodeString | — |
A19_ScbPersist HexInt32 | — |
A20_CcbFlags HexInt32 | — |
Event ID 277 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 278 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 279 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ScbVcb Pointer | — |
A12__ScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16_Scb Pointer | — |
A17_ScbAttributeTypeCode HexInt32 | — |
A18__ScbAttributeName CountedUtf16String | — |
A19_ScbPersist HexInt32 | — |
A20_CcbNULLCcbFlags0 HexInt32 | — |
Event ID 280 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11_ScbHeaderValidDataLengthQuadPart HexInt64 | — |
A12_ScbHeaderFileSizeQuadPart HexInt64 | — |
A13_QueryDaxExtentsFileOffset HexInt64 | — |
A14_StartingVcn HexInt64 | — |
A15_QueryDaxExtentsLength HexInt64 | — |
Event ID 281 —
Fields #
| Name | Description |
|---|---|
A10_QueryDaxExtentsFileOffset HexInt64 | — |
A11_QueryDaxExtentsLength HexInt64 | — |
A12_EffectiveInputFileRegionLength HexInt64 | — |
A13_StartingVcn HexInt64 | — |
A14_BeyondEndVcn HexInt64 | — |
A15_RemainingClusterCount HexInt64 | — |
A16_LastVcnInFile HexInt64 | — |
Event ID 282 —
Event ID 283 —
Fields #
| Name | Description |
|---|---|
A10_RemainingClusterCount HexInt64 | — |
A11_DataSetRangeIndex Int32 | — |
A12_OutputBufferLength Int32 | — |
Event ID 284 —
Fields #
| Name | Description |
|---|---|
A10_ExtentsDescriptorNumberOfValidRuns HexInt32 | — |
A11_MaxRuns HexInt32 | — |
A12_BytesReturned HexInt64 | — |
Event ID 285 —
Fields #
| Name | Description |
|---|---|
A10_RemainingClusterCount HexInt64 | — |
A11_ExtentsDescriptorNumberOfValidRuns HexInt32 | — |
Event ID 286 —
Fields #
| Name | Description |
|---|---|
A10_RemainingClusterCount HexInt64 | — |
A11_ExtentsDescriptorNumberOfValidRuns HexInt32 | — |
Event ID 287 —
Fields #
| Name | Description |
|---|---|
A10_ExtentsDescriptorNumberOfValidRuns HexInt32 | — |
A11_MaxRuns HexInt32 | — |
A12_Status HexInt32 | — |
A13_BytesReturned HexInt64 | — |
Event ID 288 —
Fields #
| Name | Description |
|---|---|
A10_ExtentsDescriptorRunIndexBasePage HexInt64 | — |
A11_ExtentsDescriptorRunIndexPageCount HexInt64 | — |
Event ID 289 —
Fields #
| Name | Description |
|---|---|
A10_ZeroStart HexInt64 | — |
A11_ZeroEnd HexInt64 | — |
Event ID 290 —
Fields #
| Name | Description |
|---|---|
A10_ZeroStart HexInt64 | — |
A11_ZeroEnd HexInt64 | — |
Event ID 291 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_Fcb Pointer | — |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | — |
A16_Scb Pointer | — |
A17_ScbAttributeTypeCode HexInt32 | — |
A18__ScbAttributeName CountedUtf16String | — |
A19_CcbFlags HexInt32 | — |
Event ID 292 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ScbVcb Pointer | — |
A12__ScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16_Scb Pointer | — |
A17_ScbAttributeTypeCode HexInt32 | — |
A18__ScbAttributeName CountedUtf16String | — |
A19_ARGUMENT_PRESENTCcbCcbAccessFlags0 HexInt32 | — |
A20_ARGUMENT_PRESENTCreateContextCreateContextPreviouslyGrantedAccess0 HexInt32 | — |
Event ID 293 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ScbVcb Pointer | — |
A12__ScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16_Scb Pointer | — |
A17_ScbAttributeTypeCode HexInt32 | — |
A18__ScbAttributeName CountedUtf16String | — |
A19_CcbFlags HexInt32 | — |
Event ID 294 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_FcbVcb Pointer | — |
A12__FcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | — |
A14_Fcb Pointer | — |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | — |
A16_CcbNULLCcbFlags0 HexInt32 | — |
Event ID 295 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ScbVcb Pointer | — |
A12__ScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16_Scb Pointer | — |
A17_ScbAttributeTypeCode HexInt32 | — |
A18__ScbAttributeName CountedUtf16String | — |
A19_ScbVcbVpbRealDeviceFlags HexInt32 | — |
Event ID 296 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_RenameCleanupTargetLinkFcb Pointer | — |
A15_NtfsFullFileRefNumber_RenameCleanupTargetLinkFcbFileReference HexInt64 | — |
A16_RenameCleanupTargetLinkFcbFcbState HexInt32 | — |
Event ID 297 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_RenameCleanupTargetLinkFcb Pointer | — |
A15_NtfsFullFileRefNumber_RenameCleanupTargetLinkFcbFileReference HexInt64 | — |
A16_RenameCleanupTargetLinkFcbTxfFcbTxfNumWriters Int32 | — |
Event ID 298 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_LcbToDeleteFcb Pointer | — |
A15_NtfsFullFileRefNumber_LcbToDeleteFcbFileReference HexInt64 | — |
A16_LcbToDelete Pointer | — |
A17_WppCountedStringWLcbToDeleteFileNameAttrFileNameUSHORTLcbToDeleteFileNameAttrFileNameLength CountedUtf16String | — |
A18_LcbToDeleteTxfNumWriters Int32 | — |
Event ID 299 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_RenameCleanupTargetLinkFcb Pointer | — |
A15_NtfsFullFileRefNumber_RenameCleanupTargetLinkFcbFileReference HexInt64 | — |
A16_RenameCleanupTargetLinkFcbCleanupCount Int32 | — |
Event ID 300 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_LcbToDeleteFcb Pointer | — |
A15_NtfsFullFileRefNumber_LcbToDeleteFcbFileReference HexInt64 | — |
A16_LcbToDelete Pointer | — |
A17_WppCountedStringWLcbToDeleteFileNameAttrFileNameUSHORTLcbToDeleteFileNameAttrFileNameLength CountedUtf16String | — |
A18_LcbToDeleteCleanupCount Int32 | — |
A19_SplitPrimaryLcb Pointer | — |
A20_SplitPrimaryLcbNULLWppCountedStringWSplitPrimaryLcbFileNameAttrFileNameUSHORTSplitPrimaryLcbFileNameAttrFileNameLengthWppCountedStringWNULL0 CountedUtf16String | — |
A21_SplitPrimaryLcbNULLSplitPrimaryLcbCleanupCount0 Int32 | — |
Event ID 301 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_LcbFcb Pointer | — |
A15_NtfsFullFileRefNumber_LcbFcbFileReference HexInt64 | — |
A16_LcbFcbFcbState HexInt32 | — |
A17_Lcb Pointer | — |
A18_WppCountedStringWLcbFileNameAttrFileNameUSHORTLcbFileNameAttrFileNameLength CountedUtf16String | — |
A19_LcbFileNameAttrFlags HexInt32 | — |
A20_LcbLcbState HexInt32 | — |
Event ID 302 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16_ScbFcbInfoFileAttributes HexInt32 | — |
Event ID 303 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_TargetParentScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_TargetParentScbFcbFileReference HexInt64 | — |
A16_TargetParentScbFcbFcbState HexInt32 | — |
Event ID 304 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_TargetParentScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_TargetParentScbFcbFileReference HexInt64 | — |
A16_TargetParentScbFcbInfoFileAttributes HexInt32 | — |
A17_TargetParentScbFcbFcbState HexInt32 | — |
Event ID 305 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
Event ID 306 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16_NtfsFullFileRefNumber_TargetParentScbFcbFileReference HexInt64 | — |
Event ID 307 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16__CcbFullFileName CountedUtf16String | — |
Event ID 308 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16__CcbFullFileName CountedUtf16String | — |
A17_TxfVisibleLinks Int32 | — |
Event ID 309 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16__CcbFullFileName CountedUtf16String | — |
A17_AccessStatus HexInt32 | — |
Event ID 310 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_TargetParentScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_TargetParentScbFcbFileReference HexInt64 | — |
A16__NewLinkName CountedUtf16String | — |
Event ID 311 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_TargetParentScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_TargetParentScbFcbFileReference HexInt64 | — |
A16__NewLinkName CountedUtf16String | — |
A17_TargetParentScbFcbTxfRmcbRmState HexInt32 | — |
Event ID 312 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_LcbFcb Pointer | — |
A15_NtfsFullFileRefNumber_LcbFcbFileReference HexInt64 | — |
A16_Lcb Pointer | — |
A17_WppCountedStringWLcbFileNameAttrFileNameUSHORTLcbFileNameAttrFileNameLength CountedUtf16String | — |
Event ID 313 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_LcbFcb Pointer | — |
A15_NtfsFullFileRefNumber_LcbFcbFileReference HexInt64 | — |
A16_Lcb Pointer | — |
A17_WppCountedStringWLcbFileNameAttrFileNameUSHORTLcbFileNameAttrFileNameLength CountedUtf16String | — |
A18_NtfsFullFileRefNumber_ParentScbFcbFileReference HexInt64 | — |
Event ID 314 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_NextScbVcb Pointer | — |
A12__NextScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWNextScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHNextScbVcbVpb CountedUtf16String | — |
A14_NextScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_NextScbFcbFileReference HexInt64 | — |
A16_NextScbCleanupCount Int32 | — |
Event ID 315 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_NextScbVcb Pointer | — |
A12__NextScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWNextScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHNextScbVcbVpb CountedUtf16String | — |
A14_NextScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_NextScbFcbFileReference HexInt64 | — |
A16_ByIdCcbs Int32 | — |
A17_NextScbCleanupCount Int32 | — |
Event ID 316 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ScbVcb Pointer | — |
A12__ScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16_Scb Pointer | — |
A17_ScbAttributeTypeCode HexInt32 | — |
A18__ScbAttributeName CountedUtf16String | — |
A19_ScbState HexInt32 | — |
A20_ScbScbTypeDataHighWaterMark Int64 | — |
Event ID 317 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_DirectoryScbVcb Pointer | — |
A12__DirectoryScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWDirectoryScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHDirectoryScbVcbVpb CountedUtf16String | — |
A14_DirectoryScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_DirectoryScbFcbFileReference HexInt64 | — |
A16_ULONGIrpIoStatusInformation Int32 | — |
A17_BatchOplockCount Int32 | — |
Event ID 318 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12_Fcb Pointer | — |
A13_LocalFlagsEntireFlags HexInt32 | — |
Event ID 319 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Scb Pointer | — |
Event ID 320 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12_LocalFlagsEntireFlags HexInt32 | — |
Event ID 321 —
Fields #
| Name | Description |
|---|---|
A10_VcbBitmapScb Pointer | — |
A11_Vcb Pointer | — |
Event ID 322 —
Fields #
| Name | Description |
|---|---|
A10_VcbMftScb Pointer | — |
A11_Vcb Pointer | — |
Event ID 323 —
Fields #
| Name | Description |
|---|---|
A10_PNTFS_DISK_FLUSH_CONTEXTContextVcb Pointer | — |
A11_Context Pointer | — |
Event ID 324 —
Fields #
| Name | Description |
|---|---|
A10_PNTFS_DISK_FLUSH_CONTEXTContextVcb Pointer | — |
A11_Context Pointer | — |
A12_NtfsDataDiskFlushContextCompletedWorkItemListFlink Pointer | — |
Event ID 325 —
Event ID 326 —
Event ID 327 —
Fields #
| Name | Description |
|---|---|
A10_Irp Pointer | — |
A11_IrpContext Pointer | — |
A12_IrpContextVcb Pointer | — |
A13_IrpSpMinorFunction HexInt32 | — |
A14_FsControlCode HexInt32 | — |
Event ID 328 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_VcbVcbState HexInt32 | — |
A15_VcbDisallowDismountCount Int32 | — |
A16_ExplicitLock10 Int32 | — |
A17_ReadULongNoFence_VcbCleanupCount Int32 | — |
A18_UserHandleCountSystemHandleCountVcbExternalMetadataCleanupCount Int32 | — |
Event ID 329 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_VcbVcbState HexInt32 | — |
Event ID 330 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_Status HexInt32 | — |
Event ID 331 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_Status HexInt32 | — |
Event ID 332 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_VcbCloseCount Int32 | — |
A15_VcbSystemFileCloseCount Int32 | — |
A16_UserHandleCount Int32 | — |
Event ID 333 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_CcbNULLCcbAccessFlags0 HexInt32 | — |
Event ID 334 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_ActiveRmCount Int32 | — |
A15_DefaultRmActive10 Int32 | — |
Event ID 335 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDVcbTxfVcbDefaultRm Pointer | — |
A12_VcbTxfVcbDefaultRmNULL_VcbTxfVcbDefaultRmRmIdNULL GUID | — |
Event ID 336 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_CcbNULLCcbAccessFlags0 HexInt32 | — |
Event ID 337 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_Vcb Pointer | — |
A12__VolumeLabel CountedUtf16String | — |
A13__VcbDeviceName CountedUtf16String | — |
Event ID 338 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_CcbNULLCcbAccessFlags0 HexInt32 | — |
Event ID 339 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_VcbVcbState HexInt32 | — |
Event ID 340 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_VcbVcbState HexInt32 | — |
A15_VcbReadOnlyCloseCount Int32 | — |
A16_VcbCloseCount Int32 | — |
A17_VcbSystemFileCloseCount Int32 | — |
Event ID 341 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_VcbVcbState HexInt32 | — |
Event ID 342 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_CcbNULLCcbAccessFlags0 HexInt32 | — |
Event ID 343 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_CcbNULLCcbAccessFlags0 HexInt32 | — |
Event ID 344 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_CcbAccessFlags HexInt32 | — |
Event ID 345 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_CcbAccessFlags HexInt32 | — |
Event ID 346 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_CcbAccessFlags HexInt32 | — |
Event ID 347 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_CcbNULLCcbAccessFlags0 HexInt32 | — |
A15_TypeOfOpen Int32 | — |
Event ID 348 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_CcbNULLCcbAccessFlags0 HexInt32 | — |
A15_IrpRequestorMode Int32 | — |
Event ID 349 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_CcbNULLCcbAccessFlags0 HexInt32 | — |
Event ID 350 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_CcbNULLCcbAccessFlags0 HexInt32 | — |
Event ID 351 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_CcbAccessFlags HexInt32 | — |
A15_CcbFlags HexInt32 | — |
Event ID 352 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_CcbAccessFlags HexInt32 | — |
A15_CcbFlags HexInt32 | — |
A16_CallerId Int32 | — |
A17_ContextOwnerId Int32 | — |
Event ID 353 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_Fcb Pointer | — |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | — |
A16__CcbFullFileName CountedUtf16String | — |
A17_CcbAccessFlags HexInt32 | — |
A18_FileObjectWriteAccess10 Int32 | — |
Event ID 354 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16__CcbFullFileName CountedUtf16String | — |
A17_CcbAccessFlags HexInt32 | — |
A18_ScbAttributeFlags HexInt32 | — |
Event ID 355 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ZeroFlags HexInt32 | — |
A12_IrpRequestorMode Int32 | — |
Event ID 356 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_Scb Pointer | — |
A12_IrpSpFileObject Pointer | — |
Event ID 357 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_EncryptionOperation HexInt32 | — |
Event ID 358 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_Fcb Pointer | — |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | — |
A16__CcbFullFileName CountedUtf16String | — |
A17_CcbAccessFlags HexInt32 | — |
Event ID 359 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_Fcb Pointer | — |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | — |
A16__CcbFullFileName CountedUtf16String | — |
A17_CcbAccessFlags HexInt32 | — |
Event ID 360 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_CcbNULLCcbAccessFlags0 HexInt32 | — |
Event ID 361 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_CcbNULLCcbAccessFlags0 HexInt32 | — |
Event ID 362 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_CcbNULLCcbAccessFlags0 HexInt32 | — |
Event ID 363 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 364 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 365 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_Fcb Pointer | — |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | — |
A16__CcbFullFileName CountedUtf16String | — |
A17_CcbAccessFlags HexInt32 | — |
A18_HandleInfoHandleInfo HexInt32 | — |
A19_IrpRequestorMode Int32 | — |
Event ID 366 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_DasdCcbNULLDasdCcbAccessFlags0 HexInt32 | — |
Event ID 367 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_Fcb Pointer | — |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | — |
A16_Scb Pointer | — |
A17_ScbAttributeTypeCode HexInt32 | — |
A18__ScbAttributeName CountedUtf16String | — |
A19_ScbPersist HexInt32 | — |
A20_HandleInfoHandleInfo HexInt32 | — |
Event ID 368 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_Fcb Pointer | — |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | — |
A16_FcbFcbState2 HexInt32 | — |
A17_Scb Pointer | — |
A18_ScbAttributeTypeCode HexInt32 | — |
A19__ScbAttributeName CountedUtf16String | — |
A20_ScbPersist HexInt32 | — |
A21_HandleInfoHandleInfo HexInt32 | — |
Event ID 369 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_Fcb Pointer | — |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | — |
A16_FcbFcbState HexInt32 | — |
A17_Scb Pointer | — |
A18_ScbAttributeTypeCode HexInt32 | — |
A19__ScbAttributeName CountedUtf16String | — |
A20_ScbPersist HexInt32 | — |
A21_HandleInfoHandleInfo HexInt32 | — |
A22_IrpRequestorMode Int32 | — |
Event ID 370 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16_ScbFcbFcbState HexInt32 | — |
A17_HandleInfoHandleInfo HexInt32 | — |
Event ID 371 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ScbVcb Pointer | — |
A12__ScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16_Scb Pointer | — |
A17_ScbAttributeTypeCode HexInt32 | — |
A18__ScbAttributeName CountedUtf16String | — |
A19_HandleInfoHandleInfo HexInt32 | — |
Event ID 372 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ScbVcb Pointer | — |
A12__ScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16_Scb Pointer | — |
A17_ScbAttributeTypeCode HexInt32 | — |
A18__ScbAttributeName CountedUtf16String | — |
A19_ScbShareAccessWriters Int32 | — |
Event ID 373 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_TypeOfOpen Int32 | — |
A12_Vcb Pointer | — |
A13__VcbVolumeName CountedUtf16String | — |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A15_ScbFcb Pointer | — |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | — |
A18_CcbNULLCcbAccessFlags0 HexInt32 | — |
Event ID 374 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_TypeOfOpen Int32 | — |
A15_IrpSpFileObjectWriteAccess10 Int32 | — |
A16_ScbFcb Pointer | — |
A17_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A18_ScbAttributeTypeCode HexInt32 | — |
A19_ScbFcbFcbState HexInt32 | — |
A20_CcbNULL_CcbFullFileNameNULL CountedUtf16String | — |
Event ID 375 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_CcbNULLCcbAccessFlags0 HexInt32 | — |
Event ID 376 —
Fields #
| Name | Description |
|---|---|
A10_PVOIDVcb Pointer | — |
A11_InputParameter UInt32 | — |
Event ID 377 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_CcbNULLCcbAccessFlags0 HexInt32 | — |
Event ID 378 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_CcbNULLCcbAccessFlags0 HexInt32 | — |
Event ID 379 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_IrpContextVcb Pointer | — |
A12__IrpContextVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWIrpContextVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHIrpContextVcbVpb CountedUtf16String | — |
A14_NtfsDataFlags HexInt32 | — |
Event ID 380 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_CcbNULLCcbAccessFlags0 HexInt32 | — |
Event ID 381 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_VcbVcbState HexInt32 | — |
Event ID 382 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_CcbNULLCcbAccessFlags0 HexInt32 | — |
Event ID 383 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_CcbNULLCcbAccessFlags0 HexInt32 | — |
Event ID 384 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_IrpContextVcb Pointer | — |
A12__IrpContextVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWIrpContextVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHIrpContextVcbVpb CountedUtf16String | — |
Event ID 385 —
Fields #
| Name | Description |
|---|---|
A10_ScrubResumeContextSystemScbIndex UInt32 | — |
A11_ScrubResumeContextResumeVcn HexInt64 | — |
A12_ScrubResumeContextResumeVcnOffset HexInt32 | — |
Event ID 386 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11_ScrubResumeContextResumeVcn HexInt64 | — |
A12_ScrubResumeContextResumeVcnOffset HexInt32 | — |
Event ID 387 —
Fields #
| Name | Description |
|---|---|
A10_ScrubResumeContextSystemScbIndex UInt32 | — |
Event ID 388 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_TypeOfOpen Int32 | — |
A15_ScbFcb Pointer | — |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A17__CcbFullFileName CountedUtf16String | — |
A18_CcbAccessFlags HexInt32 | — |
Event ID 389 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11_ScbTxfScb Pointer | — |
Event ID 390 —
Event ID 391 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11_ScrubContextOperationStatus HexInt32 | — |
A12_ScrubContextNumberOfBytesRepaired HexInt64 | — |
A13_ScrubContextNumberOfBytesFailed HexInt64 | — |
A14_ScrubContextErrorFileOffset HexInt64 | — |
A15_ScrubContextErrorLength HexInt64 | — |
A16_ScrubContextParityExtentDataNumberOfParityExtents UInt32 | — |
Event ID 392 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11_Status HexInt32 | — |
A12_ScrubContextNumberOfBytesRepaired HexInt64 | — |
A13_ScrubContextNumberOfBytesFailed HexInt64 | — |
A14_ScrubContextParityExtentDataNumberOfParityExtents UInt32 | — |
Event ID 393 —
Fields #
| Name | Description |
|---|---|
A10_InternalFileReference UInt32 | — |
Event ID 394 —
Fields #
| Name | Description |
|---|---|
A10_InternalFileReference UInt32 | — |
Event ID 395 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11_ScrubIoCount UInt32 | — |
A12_IrpCancel UInt32 | — |
A13_ScrubContextParityExtentDataNumberOfParityExtents UInt32 | — |
Event ID 396 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11__ScbAttributeName CountedUtf16String | — |
Event ID 397 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11__ScbAttributeName CountedUtf16String | — |
Event ID 398 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11_StartingVcn Int64 | — |
Event ID 399 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11_FileScrubOffset HexInt64 | — |
A12_SectorAlignedVdl HexInt64 | — |
Event ID 400 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11_StartingVcn HexInt64 | — |
Event ID 401 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11_StartingVcn HexInt64 | — |
A12_ClusterCount HexInt64 | — |
Event ID 402 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11_StartingVcn HexInt64 | — |
Event ID 403 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11_DsmRangeStartingOffset HexInt64 | — |
A12_DsmRangeStartingOffsetDsmRangeLengthInBytes HexInt64 | — |
A13_DsmRangeLengthInBytes HexInt64 | — |
A14_StartingVcn HexInt64 | — |
A15_StartingVcnOffset HexInt32 | — |
A16_SectorAlignedVdl HexInt64 | — |
Event ID 404 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11_StartingVcn HexInt64 | — |
A12_ScrubContextErrorFileOffset HexInt64 | — |
A13_ScrubbedLength HexInt64 | — |
A14_ScrubContextOperationStatus HexInt32 | — |
A15_ScrubContextNumberOfBytesFailed HexInt64 | — |
A16_ScrubContextNumberOfBytesRepaired HexInt64 | — |
A17_NewParityExtentCount UInt32 | — |
Event ID 405 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11_Status HexInt32 | — |
Event ID 406 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11_Status HexInt32 | — |
Event ID 407 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11_ScbTxfScb Pointer | — |
Event ID 408 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11__ScbAttributeName CountedUtf16String | — |
Event ID 409 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11__ScbAttributeName CountedUtf16String | — |
Event ID 410 —
Event ID 411 —
Event ID 412 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11_StartingVcn HexInt64 | — |
Event ID 413 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11_StartingVcn HexInt64 | — |
Event ID 414 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11_StartingVcn HexInt64 | — |
A12_ClusterCount HexInt64 | — |
Event ID 415 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11_RepairDataSetRangeStartingOffset HexInt64 | — |
A12_RepairDataSetRangeStartingOffsetRepairDataSetRangeLengthInBytes HexInt64 | — |
A13_RepairDataSetRangeLengthInBytes HexInt64 | — |
A14_RepairFileOffset HexInt64 | — |
Event ID 416 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11_Status HexInt32 | — |
Event ID 417 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11_IrpStatus HexInt32 | — |
Event ID 418 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11_RepairCopiesOutputStatus HexInt32 | — |
Event ID 419 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_TypeOfOpen Int32 | — |
A15_ScbFcb Pointer | — |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A17__CcbFullFileName CountedUtf16String | — |
A18_CcbAccessFlags HexInt32 | — |
Event ID 420 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_TypeOfOpen Int32 | — |
A15_ScbFcb Pointer | — |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | — |
A18_CcbNULLCcbAccessFlags0 HexInt32 | — |
Event ID 421 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_TypeOfOpen Int32 | — |
A15_ScbFcb Pointer | — |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | — |
A18_CcbNULLCcbAccessFlags0 HexInt32 | — |
Event ID 422 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_TypeOfOpen Int32 | — |
A15_ScbFcb Pointer | — |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | — |
A18_CcbNULLCcbAccessFlags0 HexInt32 | — |
Event ID 423 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_Fcb Pointer | — |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | — |
A16_Scb Pointer | — |
A17_ScbAttributeTypeCode HexInt32 | — |
A18__ScbAttributeName CountedUtf16String | — |
Event ID 424 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_TypeOfOpen Int32 | — |
A15_ScbFcb Pointer | — |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | — |
A18_IrpRequestorMode Int32 | — |
Event ID 425 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_TypeOfOpen Int32 | — |
A12_Vcb Pointer | — |
A13__VcbVolumeName CountedUtf16String | — |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A15_ScbFcb Pointer | — |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | — |
A18_VcbVcbState HexInt32 | — |
Event ID 426 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16_Scb Pointer | — |
A17_ScbAttributeTypeCode HexInt32 | — |
A18__ScbAttributeName CountedUtf16String | — |
A19_ScbPersist HexInt32 | — |
A20_CcbNULLCcbFlags0 HexInt32 | — |
Event ID 427 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_Fcb Pointer | — |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | — |
A16_FcbInfoFileAttributes HexInt32 | — |
A17_IrpSpFlags HexInt32 | — |
Event ID 428 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | — |
A17_IrpRequestorMode Int32 | — |
Event ID 429 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | — |
A17_VcbVcbState HexInt32 | — |
Event ID 430 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16_Scb Pointer | — |
A17_ScbAttributeTypeCode HexInt32 | — |
A18__ScbAttributeName CountedUtf16String | — |
A19_ScbPersist HexInt32 | — |
A20_CcbNULLCcbFlags0 HexInt32 | — |
Event ID 431 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_Fcb Pointer | — |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | — |
A16_FcbInfoFileAttributes HexInt32 | — |
A17_IrpSpFlags HexInt32 | — |
Event ID 432 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_NtfsFullFileRefNumber_FcbFileReference HexInt64 | — |
A15_CcbNULL_CcbFullFileNameNULL CountedUtf16String | — |
A16_CcbNULLCcbAccessFlags0 HexInt32 | — |
Event ID 433 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_TypeOfOpen Int32 | — |
A12_Vcb Pointer | — |
A13__VcbVolumeName CountedUtf16String | — |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A15_ScbFcb Pointer | — |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A17_ScbAttributeTypeCode HexInt32 | — |
A18_ScbFcbFcbState2 HexInt32 | — |
A19_CcbNULL_CcbFullFileNameNULL CountedUtf16String | — |
A20_CcbNULLCcbAccessFlags0 HexInt32 | — |
A21_CcbNULLCcbFlags20 HexInt32 | — |
Event ID 434 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_TypeOfOpen Int32 | — |
A12_Vcb Pointer | — |
A13__VcbVolumeName CountedUtf16String | — |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A15_ScbFcb Pointer | — |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A17_ScbAttributeTypeCode HexInt32 | — |
A18_CcbNULL_CcbFullFileNameNULL CountedUtf16String | — |
A19_CcbNULLCcbAccessFlags0 HexInt32 | — |
Event ID 435 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | — |
A17_CcbNULLCcbAccessFlags0 HexInt32 | — |
Event ID 436 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_PsGetCurrentThread Pointer | — |
A12_Status HexInt32 | — |
A13__DeletedFiles CountedUtf16String | — |
Event ID 437 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_PsGetCurrentThread Pointer | — |
A12_Status HexInt32 | — |
Event ID 438 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_PsGetCurrentThread Pointer | — |
A12_Status HexInt32 | — |
A13__FileNameToDelete CountedUtf16String | — |
Event ID 439 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_PsGetCurrentThread Pointer | — |
A12_Status HexInt32 | — |
Event ID 440 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_PsGetCurrentThread Pointer | — |
A12_Status HexInt32 | — |
Event ID 441 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_TypeOfOpen Int32 | — |
A12_Vcb Pointer | — |
A13__VcbVolumeName CountedUtf16String | — |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A15_ScbFcb Pointer | — |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | — |
A18_CcbNULLCcbAccessFlags0 HexInt32 | — |
A19_EffectiveMode Int32 | — |
Event ID 442 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11_StartOffset HexInt64 | — |
A12_Length HexInt64 | — |
A13_StartVcn HexInt64 | — |
A14_BeyondEndVcn HexInt64 | — |
Event ID 443 —
Fields #
| Name | Description |
|---|---|
A10_Status HexInt32 | — |
A11_OutputNumBadRanges HexInt32 | — |
Event ID 444 —
Fields #
| Name | Description |
|---|---|
A10_FsInputRangeIndex UInt32 | — |
A11_FsInputRangesFsInputRangeIndexFileOffset HexInt64 | — |
A12_FsInputRangesFsInputRangeIndexVolumeOffset HexInt64 | — |
A13_FsInputRangesFsInputRangeIndexLengthInBytes HexInt64 | — |
Event ID 445 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11_Status HexInt32 | — |
A12_BOOLEANAbnormalTermination UInt8 | — |
Event ID 446 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11_Status HexInt32 | — |
Event ID 447 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_IrpContextVcb Pointer | — |
A12__IrpContextVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWIrpContextVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHIrpContextVcbVpb CountedUtf16String | — |
Event ID 448 —
Event ID 449 —
Fields #
| Name | Description |
|---|---|
A10_Table Pointer | — |
A11_ParentScb Pointer | — |
A12__ParentScbScbTypeIndexNormalizedName CountedUtf16String | — |
A13_RemainingName CountedUtf16String | — |
Event ID 450 —
Event ID 451 —
Fields #
| Name | Description |
|---|---|
A10_FoundLcb Pointer | — |
A11__FoundLcbExactCaseLinkLinkName CountedUtf16String | — |
Event ID 452 —
Event ID 453 —
Fields #
| Name | Description |
|---|---|
A10_Table Pointer | — |
A11_NewHashEntryHashValue HexInt32 | — |
A12_NewHashEntryFullNameLength Int32 | — |
A13_NewHashEntryHashLcb Pointer | — |
A14__NewHashEntryHashLcbExactCaseLinkLinkName CountedUtf16String | — |
Event ID 454 —
Fields #
| Name | Description |
|---|---|
A10_Table Pointer | — |
A11_HashValue HexInt32 | — |
A12_HashLcb Pointer | — |
A13__HashLcbExactCaseLinkLinkName CountedUtf16String | — |
Event ID 455 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_VcbCheckpointInjectionCount Int32 | — |
Event ID 456 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_PercentFull Int32 | — |
A12_VcbWaitForCcLoggedDataActivityCount Int32 | — |
Event ID 457 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 458 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 459 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 460 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_VcbCleanCheckpointCount Int32 | — |
Event ID 461 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_VcbOverflowedDPTCount Int32 | — |
Event ID 462 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_VcbFuzzyCheckpointCount Int32 | — |
Event ID 463 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_VcbFlushOldestFOCount Int32 | — |
Event ID 464 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_NtfsFullSegmentNumber_ScbFcbFileReference HexInt64 | — |
Event ID 465 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_DirtyPageContextOldestFileObject Pointer | — |
Event ID 466 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_VcbVcbState HexInt32 | — |
Event ID 467 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 468 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 469 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_IrpContextTransactionId HexInt32 | — |
Event ID 470 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_IrpContextTransactionId HexInt32 | — |
Event ID 471 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_IrpContextOriginatingIrp Pointer | — |
A12_PsGetCurrentThread Pointer | — |
A13_IrpContextExceptionStatus HexInt32 | — |
Event ID 472 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_IrpContextOriginatingIrp Pointer | — |
A12_PsGetCurrentThread Pointer | — |
A13_IrpContextExceptionStatus HexInt32 | — |
Event ID 473 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_IrpContextOriginatingIrp Pointer | — |
A12_PsGetCurrentThread Pointer | — |
A13_IrpContextExceptionStatus HexInt32 | — |
A14_FailedFlushCount Int32 | — |
Event ID 474 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_IrpContextOriginatingIrp Pointer | — |
A12_PsGetCurrentThread Pointer | — |
A13_IrpContextExceptionStatus HexInt32 | — |
Event ID 475 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_IrpContextOriginatingIrp Pointer | — |
A12_PsGetCurrentThread Pointer | — |
A13_IrpContextExceptionStatus HexInt32 | — |
Event ID 476 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_IrpContextTransactionId HexInt32 | — |
Event ID 477 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_IrpContextTransactionId HexInt32 | — |
Event ID 478 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_ActiveLsnQuadPart HexInt64 | — |
A12_ClearAll UInt32 | — |
Event ID 479 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 480 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 481 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_ClustersClusterCount HexInt64 | — |
Event ID 482 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 483 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 484 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_Clusters Pointer | — |
A12_ClustersClusterCount HexInt64 | — |
A13_ClustersLsnQuadPart HexInt64 | — |
A14_ClustersFlags HexInt32 | — |
Event ID 485 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_Clusters Pointer | — |
A12_i Int32 | — |
A13_StartingLcn HexInt64 | — |
A14_ClusterCount HexInt64 | — |
Event ID 486 —
Event ID 487 —
Fields #
| Name | Description |
|---|---|
A10_Status HexInt32 | — |
Event ID 488 —
Fields #
| Name | Description |
|---|---|
A10_Status HexInt32 | — |
Event ID 489 —
Fields #
| Name | Description |
|---|---|
A10_Status HexInt32 | — |
Event ID 490 —
Fields #
| Name | Description |
|---|---|
A10_Status HexInt32 | — |
Event ID 491 —
Event ID 492 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_StartingLcn HexInt64 | — |
A12_ULONGClusterCount HexInt32 | — |
Event ID 493 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_StartingLcnStartingIndex HexInt64 | — |
A12_runLength HexInt32 | — |
Event ID 494 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_Status HexInt32 | — |
Event ID 495 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_MarkUnusedContext Pointer | — |
Event ID 496 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 497 —
Fields #
| Name | Description |
|---|---|
A10_McbScb Pointer | — |
A11_Mcb Pointer | — |
A12_StartingVcn HexInt64 | — |
A13_Count HexInt64 | — |
Event ID 498 —
Fields #
| Name | Description |
|---|---|
A10_Mcb Pointer | — |
Event ID 499 —
Fields #
| Name | Description |
|---|---|
A10_McbScb Pointer | — |
A11_Mcb Pointer | — |
A12_Vcn HexInt64 | — |
A13_Lcn HexInt64 | — |
A14_RunCount HexInt64 | — |
Event ID 500 —
Fields #
| Name | Description |
|---|---|
A10_Mcb Pointer | — |
A11_Result UInt32 | — |
Event ID 501 —
Fields #
| Name | Description |
|---|---|
A10_McbScb Pointer | — |
A11_Mcb Pointer | — |
A12_StartingVcn HexInt64 | — |
A13_EndingVcn HexInt64 | — |
A14_TruncateOnly UInt32 | — |
Event ID 502 —
Fields #
| Name | Description |
|---|---|
A10_Mcb Pointer | — |
Event ID 503 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_BootSector Pointer | — |
Event ID 504 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_BootSector Pointer | — |
A12_CheckNumber Int32 | — |
Event ID 505 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_IrpContextExceptionStatus HexInt32 | — |
Event ID 506 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_Vcb Pointer | — |
A12__VolumeLabel CountedUtf16String | — |
A13__VcbDeviceName CountedUtf16String | — |
Event ID 507 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 508 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 509 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
Event ID 510 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_AttrListAllocationSize HexInt64 | — |
Event ID 511 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_Scb Pointer | — |
A13_AttrListAllocationSize HexInt64 | — |
Event ID 512 —
Fields #
| Name | Description |
|---|---|
A10_ExceptionCode HexInt32 | — |
Event ID 513 —
Fields #
| Name | Description |
|---|---|
A10_ExceptionCode HexInt32 | — |
Event ID 514 —
Fields #
| Name | Description |
|---|---|
A10_ExceptionCode HexInt32 | — |
Event ID 515 —
Fields #
| Name | Description |
|---|---|
A10_IrpContextLogFullReason UInt32 | — |
A11_BackTrace0 Pointer | — |
A12_BackTrace1 Pointer | — |
A13_BackTrace2 Pointer | — |
A14_BackTrace3 Pointer | — |
A15_BackTrace4 Pointer | — |
A16_BackTrace5 Pointer | — |
A17_BackTrace6 Pointer | — |
A18_BackTrace7 Pointer | — |
A19_BackTrace8 Pointer | — |
A20_BackTrace9 Pointer | — |
A21_BackTrace10 Pointer | — |
A22_BackTrace11 Pointer | — |
A23_BackTrace12 Pointer | — |
A24_BackTrace13 Pointer | — |
A25_BackTrace14 Pointer | — |
A26_BackTrace15 Pointer | — |
A27_BackTrace16 Pointer | — |
A28_BackTrace17 Pointer | — |
A29_BackTrace18 Pointer | — |
A30_BackTrace19 Pointer | — |
Event ID 516 —
Fields #
| Name | Description |
|---|---|
A10_ExceptionCode HexInt32 | — |
Event ID 517 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_ExceptionCode HexInt32 | — |
Event ID 518 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_ExceptionCode HexInt32 | — |
Event ID 519 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_Irp Pointer | — |
A12_IrpContextVcb Pointer | — |
A13_NtfsFailedAborts HexInt32 | — |
A14_GetExceptionCode HexInt32 | — |
Event ID 520 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_Irp Pointer | — |
A12_IrpContextVcb Pointer | — |
A13_NextScb Pointer | — |
A14_PULONGLONG_NextScbFcbFileReference HexInt64 | — |
Event ID 521 —
Fields #
| Name | Description |
|---|---|
A10_IrpSpParametersWriteByteOffsetHighPart HexInt32 | — |
A11_IrpSpParametersWriteByteOffsetLowPart HexInt32 | — |
Event ID 522 —
Fields #
| Name | Description |
|---|---|
A10_ExceptionCode HexInt32 | — |
A11_IrpSpParametersWriteByteOffsetHighPart HexInt32 | — |
A12_IrpSpParametersWriteByteOffsetLowPart HexInt32 | — |
Event ID 523 —
Fields #
| Name | Description |
|---|---|
A10_IrpSpMajorFunction UInt32 | — |
A11_IrpSpMinorFunction HexInt32 | — |
A12_Irp Pointer | — |
A13_IrpContext Pointer | — |
A14_Status HexInt32 | — |
Event ID 524 —
Fields #
| Name | Description |
|---|---|
A10_IrpSpMajorFunction UInt32 | — |
A11_IrpSpMinorFunction HexInt32 | — |
A12_Irp Pointer | — |
A13_IrpContext Pointer | — |
A14_Status HexInt32 | — |
Event ID 525 —
Event ID 526 —
Event ID 527 —
Fields #
| Name | Description |
|---|---|
A10_MinTrimTotalSize HexInt32 | — |
Event ID 528 —
Fields #
| Name | Description |
|---|---|
A10_MaxTrimTotalSize HexInt32 | — |
Event ID 529 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ScbVcb Pointer | — |
A12__ScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16__CcbFullFileName CountedUtf16String | — |
A17_CcbAccessFlags HexInt32 | — |
A18_IrpSpMinorFunction HexInt32 | — |
Event ID 530 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ScbVcb Pointer | — |
A12__ScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16__CcbFullFileName CountedUtf16String | — |
A17_CcbAccessFlags HexInt32 | — |
A18_IrpSpMinorFunction HexInt32 | — |
Event ID 531 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ScbVcb Pointer | — |
A12__ScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16__CcbFullFileName CountedUtf16String | — |
A17_CcbAccessFlags HexInt32 | — |
A18_IrpSpMinorFunction HexInt32 | — |
Event ID 532 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDVcbTxfVcbDefaultRm Pointer | — |
A12__VcbTxfVcbDefaultRmRmId GUID | — |
Event ID 533 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_IrpContextVcb Pointer | — |
A12__IrpContextVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWIrpContextVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHIrpContextVcbVpb CountedUtf16String | — |
Event ID 534 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_TypeOfOpen Int32 | — |
A12_Vcb Pointer | — |
A13__VcbVolumeName CountedUtf16String | — |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A15_ScbFcb Pointer | — |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A17__CcbFullFileName CountedUtf16String | — |
A18_CcbAccessFlags HexInt32 | — |
A19_CcbFlags HexInt32 | — |
Event ID 535 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
Event ID 536 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_Fcb Pointer | — |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | — |
A16__CcbFullFileName CountedUtf16String | — |
A17_CcbAccessFlags HexInt32 | — |
A18_IrpSpFileObjectWriteAccess Int32 | — |
Event ID 537 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_Fcb Pointer | — |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | — |
A16__CcbFullFileName CountedUtf16String | — |
A17_CcbAccessFlags HexInt32 | — |
A18_IrpSpFileObjectWriteAccess Int32 | — |
Event ID 538 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_Fcb Pointer | — |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | — |
A16__CcbFullFileName CountedUtf16String | — |
A17_CcbAccessFlags HexInt32 | — |
A18_IrpSpFileObjectWriteAccess Int32 | — |
Event ID 539 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_VcbLogFileObject Pointer | — |
A12_IrpContext Pointer | — |
Event ID 540 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
Event ID 541 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_VcbLogFileObject Pointer | — |
A12_IrpContext Pointer | — |
Event ID 542 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_IrpContextTransactionId HexInt32 | — |
Event ID 543 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_IrpContextTransactionId HexInt32 | — |
Event ID 544 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_FileRecordSegmentNumberHighPart HexInt32 | — |
A12_FileRecordSegmentNumberLowPart HexInt32 | — |
A13_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 | — |
Event ID 545 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_FileRecordSegmentNumberHighPart HexInt32 | — |
A12_FileRecordSegmentNumberLowPart HexInt32 | — |
A13_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 | — |
Event ID 546 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_FileRecordSegmentNumberHighPart HexInt32 | — |
A12_FileRecordSegmentNumberLowPart HexInt32 | — |
A13_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 | — |
A14_AttributeTypeCode HexInt32 | — |
A15_LogRecordRecordOffset HexInt32 | — |
A16_Length HexInt32 | — |
Event ID 547 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_FileRecordSegmentNumberHighPart HexInt32 | — |
A12_FileRecordSegmentNumberLowPart HexInt32 | — |
A13_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 | — |
A14_PATTRIBUTE_RECORD_HEADERDataTypeCode HexInt32 | — |
Event ID 548 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_FileRecordSegmentNumberHighPart HexInt32 | — |
A12_FileRecordSegmentNumberLowPart HexInt32 | — |
A13_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 | — |
A14_NtfsFullSegmentNumber_FileReference HexInt64 | — |
Event ID 549 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_FileRecordSegmentNumberHighPart HexInt32 | — |
A12_FileRecordSegmentNumberLowPart HexInt32 | — |
A13_NtfsFullSegmentNumber_FileRecordBaseFileRecordSegment HexInt64 | — |
A14_AttributeFormNonresidentAllocatedLength HexInt64 | — |
A15_AttributeFormNonresidentFileSize HexInt64 | — |
A16_AttributeFormNonresidentValidDataLength HexInt64 | — |
A17_AttributeFormNonresidentTotalAllocated HexInt64 | — |
A18_SizesAllocationSize HexInt64 | — |
A19_SizesFileSize HexInt64 | — |
A20_SizesValidDataLength HexInt64 | — |
A21_SizesTotalAllocated HexInt64 | — |
Event ID 550 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_Vcb Pointer | — |
A12__Bitmap Pointer | — |
Event ID 551 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_Vcb Pointer | — |
A12__Bitmap Pointer | — |
Event ID 552 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_FcbVcb Pointer | — |
A12__FcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | — |
A14_Fcb Pointer | — |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | — |
Event ID 553 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_FcbVcb Pointer | — |
A12__FcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | — |
A14_Fcb Pointer | — |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | — |
A16__CcbFullFileName CountedUtf16String | — |
A17_CcbAccessFlags HexInt32 | — |
Event ID 554 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_FcbVcb Pointer | — |
A12__FcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | — |
A14_Fcb Pointer | — |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | — |
A16__CcbFullFileName CountedUtf16String | — |
Event ID 555 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ThisFcbVcb Pointer | — |
A12__ThisFcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | — |
A14_ThisFcb Pointer | — |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | — |
A16_ThisFcbTxfFcbTxfNumWriters Int32 | — |
Event ID 556 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ThisFcbVcb Pointer | — |
A12__ThisFcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | — |
A14_ThisFcb Pointer | — |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | — |
A16_Status HexInt32 | — |
Event ID 557 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ThisFcbVcb Pointer | — |
A12__ThisFcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | — |
A14_ThisFcb Pointer | — |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | — |
A16_ThisFcbInfoFileAttributes HexInt32 | — |
Event ID 558 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ThisFcbVcb Pointer | — |
A12__ThisFcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | — |
A14_ThisFcb Pointer | — |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | — |
A16_ThisFcbInfoFileAttributes HexInt32 | — |
Event ID 559 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ThisFcbVcb Pointer | — |
A12__ThisFcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | — |
A14_ThisFcb Pointer | — |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | — |
Event ID 560 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ThisFcbVcb Pointer | — |
A12__ThisFcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | — |
A14_ThisFcb Pointer | — |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | — |
A16_ThisFcbInfoFileAttributes HexInt32 | — |
A17_IrpSpFlags HexInt32 | — |
Event ID 561 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ThisFcbVcb Pointer | — |
A12__ThisFcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | — |
A14_ThisFcb Pointer | — |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | — |
A16_CcbAccessFlags HexInt32 | — |
A17_AccessStatus HexInt32 | — |
Event ID 562 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ThisFcbVcb Pointer | — |
A12__ThisFcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWThisFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHThisFcbVcbVpb CountedUtf16String | — |
A14_ThisFcb Pointer | — |
A15_NtfsFullFileRefNumber_ThisFcbFileReference HexInt64 | — |
A16_NextScb Pointer | — |
A17_NextScbAttributeTypeCode HexInt32 | — |
A18__NextScbAttributeName CountedUtf16String | — |
Event ID 563 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | — |
A17_CcbNULLCcbAccessFlags0 HexInt32 | — |
Event ID 564 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_VcbVcbState HexInt32 | — |
Event ID 565 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_Fcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | — |
A17_CcbNULLCcbAccessFlags0 HexInt32 | — |
Event ID 566 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_Fcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | — |
A17_CcbNULLCcbAccessFlags0 HexInt32 | — |
Event ID 567 —
Event ID 568 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_TypeOfOpen Int32 | — |
A12_Vcb Pointer | — |
A13__VcbVolumeName CountedUtf16String | — |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A15_Fcb Pointer | — |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | — |
A18_CcbNULLCcbAccessFlags0 HexInt32 | — |
Event ID 569 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_TypeOfOpen Int32 | — |
A12_Vcb Pointer | — |
A13__VcbVolumeName CountedUtf16String | — |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A15_Fcb Pointer | — |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | — |
A18_CcbNULLCcbAccessFlags0 HexInt32 | — |
Event ID 570 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_TypeOfOpen Int32 | — |
A12_Vcb Pointer | — |
A13__VcbVolumeName CountedUtf16String | — |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A15_Fcb Pointer | — |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | — |
A18_CcbNULLCcbAccessFlags0 HexInt32 | — |
Event ID 571 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_FcbVcb Pointer | — |
A12__FcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | — |
A14_Fcb Pointer | — |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | — |
A16_FcbFcbState HexInt32 | — |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | — |
Event ID 572 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_FcbVcb Pointer | — |
A12__FcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | — |
A14_Fcb Pointer | — |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | — |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | — |
A17_CcbNULLCcbAccessFlags0 HexInt32 | — |
Event ID 573 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_Fcb Pointer | — |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | — |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | — |
A17_CcbNULLCcbAccessFlags0 HexInt32 | — |
A18_Flags HexInt32 | — |
Event ID 574 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_Fcb Pointer | — |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | — |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | — |
A17_CcbNULLCcbAccessFlags0 HexInt32 | — |
Event ID 575 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_Status HexInt32 | — |
Event ID 576 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_Status HexInt32 | — |
Event ID 577 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
A11_ScbTotalAllocated HexInt64 | — |
Event ID 578 —
Fields #
| Name | Description |
|---|---|
A10_CurrentClusters Pointer | — |
A11_CurrentClustersLsnQuadPart HexInt64 | — |
Event ID 579 —
Fields #
| Name | Description |
|---|---|
A10_ClustersLinkAsHead Pointer | — |
A11_FlagsToMatch HexInt32 | — |
A12_InsertAfter UInt32 | — |
Event ID 580 —
Fields #
| Name | Description |
|---|---|
A10_Clusters Pointer | — |
A11_ClustersFlags HexInt32 | — |
Event ID 581 —
Fields #
| Name | Description |
|---|---|
A10_Clusters Pointer | — |
A11_NumberOfRuns HexInt32 | — |
Event ID 582 —
Fields #
| Name | Description |
|---|---|
A10_Clusters Pointer | — |
Event ID 583 —
Event ID 584 —
Fields #
| Name | Description |
|---|---|
A10_FlagOnClustersFlagsDEALLOCATED_CLUSTERS_FLAG_NO_DANGLING_MDL UInt32 | — |
A11_Clusters Pointer | — |
A12_Lcn HexInt64 | — |
A13_ClusterCount HexInt64 | — |
Event ID 585 —
Fields #
| Name | Description |
|---|---|
A10_FlagOnClustersFlagsDEALLOCATED_CLUSTERS_FLAG_NO_DANGLING_MDL UInt32 | — |
A11_Clusters Pointer | — |
A12_Lcn HexInt64 | — |
A13_ClusterCount HexInt64 | — |
Event ID 586 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ScbVcb Pointer | — |
A12__ScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16_TxfFcbFlags HexInt32 | — |
A17_ShareMode HexInt32 | — |
Event ID 587 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ScbVcb Pointer | — |
A12__ScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16_GrantedAccess HexInt32 | — |
Event ID 588 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ScbVcb Pointer | — |
A12__ScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16_GrantedAccess HexInt32 | — |
Event ID 589 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ScbVcb Pointer | — |
A12__ScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16_GrantedAccess HexInt32 | — |
A17_NextTxfVscbReaderCleanupCount Int32 | — |
Event ID 590 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_CallerFunction AnsiString | — |
A12_CallerFile AnsiString | — |
A13_CallerLineNumber Int32 | — |
A14_PVOIDTxfRmcb Pointer | — |
A15__TxfRmcbRmId GUID | — |
A16_PVOIDTxfTrans Pointer | — |
A17__TxfTransKtmUow GUID | — |
A18_AbortReasonStatus HexInt32 | — |
Event ID 591 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_CallerFunction AnsiString | — |
A12_CallerFile AnsiString | — |
A13_CallerLineNumber Int32 | — |
A14_PVOIDTxfRmcb Pointer | — |
A15__TxfRmcbRmId GUID | — |
A16_PVOIDTxfTrans Pointer | — |
A17__TxfTransKtmUow GUID | — |
A18_Status HexInt32 | — |
Event ID 592 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
A13_TxfTrans Pointer | — |
A14__TxfTransKtmUow GUID | — |
Event ID 593 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
A13_TxfTrans Pointer | — |
A14__TxfTransKtmUow GUID | — |
Event ID 594 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDCalloutParametersTxfFlushTxfRmcb Pointer | — |
A12__CalloutParametersTxfFlushTxfRmcbRmId GUID | — |
A13_GetExceptionCode HexInt32 | — |
Event ID 595 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
Event ID 596 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
Event ID 597 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
Event ID 598 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
Event ID 599 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
Event ID 600 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
Event ID 601 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
Event ID 602 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_FailureStatus HexInt32 | — |
Event ID 603 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_FailureStatus HexInt32 | — |
Event ID 604 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_Status HexInt32 | — |
Event ID 605 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_VcbTxfVcbFlags HexInt32 | — |
Event ID 606 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_TempStatus HexInt32 | — |
A12_PVOIDVcb Pointer | — |
Event ID 607 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_GetExceptionCode HexInt32 | — |
A12_Status HexInt32 | — |
A13_PVOIDVcb Pointer | — |
Event ID 608 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDVcb Pointer | — |
A12_TXF_MAX_RESET_ATTEMPTS_ON_MOUNT Int32 | — |
A13_OldStatus HexInt32 | — |
Event ID 609 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_GetExceptionCode HexInt32 | — |
A12_PVOIDVcb Pointer | — |
Event ID 610 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_NT_SUCCESSStatusSucceededFAILED AnsiString | — |
A12_PVOIDTxfRmcb Pointer | — |
A13__TxfRmcbRmId GUID | — |
A14_Status HexInt32 | — |
Event ID 611 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 612 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 613 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 614 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_VcbTxfVcbFlags HexInt32 | — |
Event ID 615 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 616 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_VcbTxfVcbFlags HexInt32 | — |
Event ID 617 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 618 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
A13_LogNestingLevel HexInt32 | — |
A14_DiskNestingLevel HexInt32 | — |
Event ID 619 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 620 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 621 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
A13__ClfsRestartAreaRmId GUID | — |
Event ID 622 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_Status Int32 | — |
A12_PVOIDTxfRmcb Pointer | — |
A13__TxfRmcbRmId GUID | — |
Event ID 623 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 624 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 625 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 626 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
A13_Status HexInt32 | — |
A14_AbnormalTerminationabnormaltermination AnsiString | — |
Event ID 627 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_TxfIsDefaultRmTxfRmcbdefaultsecondary AnsiString | — |
A12_PVOIDTxfRmcb Pointer | — |
A13__TxfRmcbRmId GUID | — |
A14_ForceDirtyShutdownDIRTYCLEAN AnsiString | — |
Event ID 628 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 629 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_FcbVcb Pointer | — |
A12__FcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | — |
A14_Fcb Pointer | — |
A15_NtfsFullFileRefNumber_FcbFileReference HexInt64 | — |
A16_FcbCleanupCount Int32 | — |
Event ID 630 —
Fields #
| Name | Description |
|---|---|
A10_FILEID_FROM_SOURCEFileNLine UInt32 | — |
A11_LINENUM_FROM_SOURCEFileNLine Int32 | — |
A12_TxfRmcb Pointer | — |
A13__TxfRmcbRmId GUID | — |
A14_Status HexInt32 | — |
Event ID 631 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__OldGuid GUID | — |
A13__TxfRmcbRmId GUID | — |
Event ID 632 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
A13_PVOIDTxfTrans Pointer | — |
A14__TxfTransKtmUow GUID | — |
A15_Status HexInt32 | — |
Event ID 633 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__OldGuid GUID | — |
A13__TxfRmcbRmId GUID | — |
Event ID 634 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_RmRootFcbVcb Pointer | — |
A12__RmRootFcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWRmRootFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHRmRootFcbVcbVpb CountedUtf16String | — |
A14_RmRootFcb Pointer | — |
Event ID 635 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_FcbVcb Pointer | — |
A12__FcbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWFcbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHFcbVcbVpb CountedUtf16String | — |
A14_BackupInfoFlags HexInt32 | — |
Event ID 636 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 637 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_Status HexInt32 | — |
A12_PVOIDFileObject Pointer | — |
Event ID 638 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 639 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ScbVcb Pointer | — |
A12__ScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16_Scb Pointer | — |
A17_ScbAttributeTypeCode HexInt32 | — |
A18__CcbFullFileName CountedUtf16String | — |
A19_CcbFlags HexInt32 | — |
Event ID 640 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ScbVcb Pointer | — |
A12__ScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16_Scb Pointer | — |
A17_CcbTxfFo Pointer | — |
A18_CcbTxfFoKtmTrans Pointer | — |
A19_ScbFcbTxfRmcb Pointer | — |
A20_CcbFullFileNameBuffer UnicodeString | — |
Event ID 641 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ScbVcb Pointer | — |
A12__ScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16_Scb Pointer | — |
A17__CcbFullFileName CountedUtf16String | — |
A18_CcbAccessFlags HexInt32 | — |
A19_FileObjectWriteAccess Int32 | — |
A20_FileObjectDeleteAccess Int32 | — |
Event ID 642 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
A13_ExceptionCode HexInt32 | — |
Event ID 643 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_TransactionNotification HexInt32 | — |
A12_TransactionAlreadyPreparedPREPARED AnsiString | — |
A13__TxfTransKtmUow GUID | — |
A14_PVOIDTxfRmcb Pointer | — |
A15__TxfRmcbRmId GUID | — |
A16_Status HexInt32 | — |
Event ID 644 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
A13_TxfTrans Pointer | — |
A14__TxfTransKtmUow GUID | — |
Event ID 645 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
A13_TxfTrans Pointer | — |
A14__TxfTransKtmUow GUID | — |
Event ID 646 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTransTxfRmcb Pointer | — |
A12__TransTxfRmcbRmId GUID | — |
A13_FlushStatus HexInt32 | — |
Event ID 647 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
A13_Trans Pointer | — |
A14__TransKtmUow GUID | — |
Event ID 648 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_CallStack0 Pointer | — |
A12_CallStack1 Pointer | — |
A13_CallStack2 Pointer | — |
A14_CallStack3 Pointer | — |
A15_CallStack4 Pointer | — |
Event ID 649 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
A13_Trans Pointer | — |
A14__TransKtmUow GUID | — |
Event ID 650 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_Status HexInt32 | — |
A12_PVOIDTrans Pointer | — |
A13__TransKtmUow GUID | — |
A14_PVOIDTxfRmcb Pointer | — |
A15__TxfRmcbRmId GUID | — |
Event ID 651 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_Status HexInt32 | — |
A12_PVOIDTxfRmcb Pointer | — |
A13__TxfRmcbRmId GUID | — |
A14_PVOIDTrans Pointer | — |
A15__TransKtmUow GUID | — |
Event ID 652 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 653 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 654 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 655 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 656 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
A13_OldestTrans Pointer | — |
A14__OldestTransKtmUow GUID | — |
Event ID 657 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
A13_Status HexInt32 | — |
A14_OldestTrans Pointer | — |
A15__OldestTransKtmUow GUID | — |
Event ID 658 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 659 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 660 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
A13_PVOIDTransToDereference Pointer | — |
A14__TransToDereferenceKtmUow GUID | — |
A15_Status HexInt32 | — |
Event ID 661 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 662 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 663 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PinnedStatus HexInt32 | — |
A12_PVOIDTxfRmcb Pointer | — |
A13__TxfRmcbRmId GUID | — |
A14_Status HexInt32 | — |
Event ID 664 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 665 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 666 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 667 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 668 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 669 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 670 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 671 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 672 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 673 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 674 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
A13_IsEncrypted_TopsFcbInfoencryptedcompressed AnsiString | — |
Event ID 675 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 676 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 677 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 678 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 679 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 680 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 681 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 682 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 683 —
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | — |
A11_PVOIDTxfRmcb Pointer | — |
A12__TxfRmcbRmId GUID | — |
Event ID 684 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_TypeOfOpen Int32 | — |
A12_Vcb Pointer | — |
A13__VcbVolumeName CountedUtf16String | — |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A15_Fcb Pointer | — |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | — |
A18_CcbNULLCcbAccessFlags0 HexInt32 | — |
Event ID 685 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_VcbFirstValidUsn HexInt64 | — |
A13_FirstValidUsn HexInt64 | — |
A14_TrackUsnJournalFileSize HexInt64 | — |
A15_TrackUsnJournalAllocationSize HexInt64 | — |
A16_TrackUsnJournalMaxSize HexInt64 | — |
A17_TrackUsnJournalDeltaAllocation HexInt64 | — |
Event ID 686 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_FirstValidUsn1 HexInt64 | — |
A13_SavedReserved HexInt64 | — |
A14_RequiredReserved HexInt64 | — |
Event ID 687 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_UsnJournalHeaderAllocationSizeQuadPart HexInt64 | — |
A13_UsnJournalHeaderFileSizeQuadPart HexInt64 | — |
A14_UsnJournalHeaderValidDataLengthQuadPart HexInt64 | — |
A15_UsnJournalTotalAllocated HexInt64 | — |
Event ID 688 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_UsnJournalHeaderAllocationSizeQuadPart HexInt64 | — |
A13_UsnJournalHeaderFileSizeQuadPart HexInt64 | — |
A14_UsnJournalHeaderValidDataLengthQuadPart HexInt64 | — |
A15_UsnJournalTotalAllocated HexInt64 | — |
Event ID 689 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
Event ID 690 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
Event ID 691 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_TypeOfOpen Int32 | — |
A12_Vcb Pointer | — |
A13__VcbVolumeName CountedUtf16String | — |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A15_Fcb Pointer | — |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
Event ID 692 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_Fcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16_CcbNULL_CcbFullFileNameNULL CountedUtf16String | — |
A17_CcbNULLCcbAccessFlags0 HexInt32 | — |
Event ID 693 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_TypeOfOpen Int32 | — |
A12_Vcb Pointer | — |
A13__VcbVolumeName CountedUtf16String | — |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A15_Fcb Pointer | — |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A17_CcbNULL_CcbFullFileNameNULL CountedUtf16String | — |
A18_CcbNULLCcbAccessFlags0 HexInt32 | — |
Event ID 694 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_ScbVcb Pointer | — |
A12__ScbVcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWScbVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHScbVcbVpb CountedUtf16String | — |
A14_ScbFcb Pointer | — |
A15_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A16_Scb Pointer | — |
A17_ScbAttributeTypeCode HexInt32 | — |
A18__ScbAttributeName CountedUtf16String | — |
A19_ScbCleanupCount Int32 | — |
Event ID 695 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_IrpContextOriginatingIrp Pointer | — |
A13_PsGetCurrentThread Pointer | — |
A14_ScbHeaderAllocationSizeQuadPart HexInt64 | — |
A15_ScbHeaderFileSizeQuadPart HexInt64 | — |
A16_ScbHeaderValidDataLengthQuadPart HexInt64 | — |
A17_NewAllocationSize HexInt64 | — |
Event ID 696 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_IrpContextOriginatingIrp Pointer | — |
A13_PsGetCurrentThread Pointer | — |
A14_ScbHeaderAllocationSizeQuadPart HexInt64 | — |
A15_ScbHeaderFileSizeQuadPart HexInt64 | — |
A16_ScbHeaderValidDataLengthQuadPart HexInt64 | — |
A17_ScbTotalAllocated HexInt64 | — |
Event ID 697 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_IrpContextOriginatingIrp Pointer | — |
A13_PsGetCurrentThread Pointer | — |
Event ID 698 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_IrpContext Pointer | — |
A12_IrpContextOriginatingIrp Pointer | — |
A13_PsGetCurrentThread Pointer | — |
Event ID 699 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_IrpContextOriginatingIrp Pointer | — |
A12_PsGetCurrentThread Pointer | — |
A13_IrpContextExceptionStatus HexInt32 | — |
Event ID 700 —
Fields #
| Name | Description |
|---|---|
A10_RemainingClusterCount HexInt64 | — |
A11_Scb Pointer | — |
A12_Vcn HexInt64 | — |
A13_Lcn HexInt64 | — |
A14_ClusterCount HexInt64 | — |
Event ID 701 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 702 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 703 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 704 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 705 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 706 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 707 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
Event ID 708 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_Vcb Pointer | — |
A12__VolumeLabel CountedUtf16String | — |
A13__VcbDeviceName CountedUtf16String | — |
Event ID 709 —
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | — |
A11_Status HexInt32 | — |
A12_FileReference Pointer | — |
A13_Fcb Pointer | — |
A14_Source HexInt64 | — |
A15_TopLevelExceptionStatus HexInt32 | — |
Event ID 710 —
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | — |
A11_WasDirty HexInt32 | — |
A12_NtfsFullSegmentNumber_BugCheckFileReference HexInt64 | — |
A13_Source HexInt64 | — |
Event ID 711 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_TypeOfOpen Int32 | — |
A12_Vcb Pointer | — |
A13__VcbVolumeName CountedUtf16String | — |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A15_Fcb Pointer | — |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A17_FsInformationClass HexInt32 | — |
A18_Scb Pointer | — |
Event ID 712 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_TypeOfOpen Int32 | — |
A12_Vcb Pointer | — |
A13__VcbVolumeName CountedUtf16String | — |
A14_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A15_Fcb Pointer | — |
A16_NtfsFullFileRefNumber_ScbFcbFileReference HexInt64 | — |
A17_FsInformationClass HexInt32 | — |
A18_Scb Pointer | — |
Event ID 713 —
Fields #
| Name | Description |
|---|---|
A10_IrpSpParametersWriteByteOffsetHighPart HexInt32 | — |
A11_IrpSpParametersWriteByteOffsetLowPart HexInt32 | — |
A12_IrpContextTopLevelIrpContextExceptionStatus HexInt32 | — |
Event ID 714 —
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | — |
Event ID 715 —
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread Pointer | — |
A11_Vcb Pointer | — |
A12__VcbVolumeName CountedUtf16String | — |
A13_WppCountedStringWVcbVpbVolumeLabelSAFE_VPB_VOLUME_LABEL_LENGTHVcbVpb CountedUtf16String | — |
A14_ByteRange HexInt64 | — |
A15_HIGHEST_WRITABLE_SECTOR_ON_ACTIVE_VOLUMEVcbSectorSizeInfoLogicalBytesPerSector HexInt64 | — |
Event ID 716 —
Fields #
| Name | Description |
|---|---|
A10_StartingVbo HexInt64 | — |
A11_ScbHeaderValidDataLengthQuadPart HexInt64 | — |
A12_ptrdiff_tScb Pointer | — |
Event ID 717 —
Fields #
| Name | Description |
|---|---|
A10_ByteRange HexInt64 | — |
A11_SectorAlignedVdl HexInt64 | — |
A12_ptrdiff_tScb Pointer | — |