DFIRHub

Windows event log · Microsoft-Windows-Ntfs/Operational151 File deletion on an NTFS-formatted volume

Appears to be only present in W10 2004+

  • Windows operational
  • 7 fields
  • Microsoft-Windows-Ntfs%4Operational.evtx
  • Microsoft-Windows-Ntfs

Fields EvtxECmd extracts

7 columns in the EvtxECmd CSV

  • ExecutableInfo%ProcessName%
    • %ProcessName% = /Event/EventData/Data[@Name="ProcessName"]
  • PayloadData1In the past %SecondsElapsed% seconds %TotalCountDeleteFile% files were deleted
    • %SecondsElapsed% = /Event/EventData/Data[@Name="SecondsElapsed"]
    • %TotalCountDeleteFile% = /Event/EventData/Data[@Name="TotalCountDeleteFile"]
  • PayloadData2%TotalCountDeleteFileLogged% of the deletions record their process name
    • %TotalCountDeleteFileLogged% = /Event/EventData/Data[@Name="TotalCountDeleteFileLogged"]
  • PayloadData3%CountDeleteFile% files were deleted by %ProcessName%
    • %CountDeleteFile% = /Event/EventData/Data[@Name="CountDeleteFile"]
    • %ProcessName% = /Event/EventData/Data[@Name="ProcessName"]
  • PayloadData4VolumeName: %VolumeName%
    • %VolumeName% = /Event/EventData/Data[@Name="VolumeName"]
  • PayloadData5IsBootVolume: %IsBootVolume%
    • %IsBootVolume% = /Event/EventData/Data[@Name="IsBootVolume"]
  • PayloadData6VolumeCorrelationId: %VolumeCorrelationId%
    • %VolumeCorrelationId% = /Event/EventData/Data[@Name="VolumeCorrelationId"]

Sample event

Event XML from the map file

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <Event>
    <System>
      <Provider Name="Microsoft-Windows-Ntfs" Guid="3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482"/>
      <EventID>151</EventID>
      <Version>0</Version>
      <Level>4</Level>
      <Task>0</Task>
      <Opcode>0</Opcode>
      <Keywords>0x4000000000200000</Keywords>
      <TimeCreated SystemTime="2020-10-24 16:23:29.5220559"/>
      <EventRecordID>38</EventRecordID>
      <Correlation/>
      <Execution ProcessID="4" ThreadID="8464"/>
      <Channel>Microsoft-Windows-Ntfs/Operational</Channel>
      <Computer>HOSTNAME</Computer>
      <Security UserID="S-1-5-18"/>
    </System>
    <EventData>
      <Data Name="VolumeCorrelationId">5285666e-f228-11ea-9a5f-9c5c8ebbb369</Data>
      <Data Name="VolumeNameLength">2</Data>
      <Data Name="VolumeName">C:</Data>
      <Data Name="IsBootVolume">True</Data>
      <Data Name="SecondsElapsed">3601</Data>
      <Data Name="TotalCountDeleteFile">1963</Data>
      <Data Name="TotalCountDeleteFileLogged">1963</Data>
      <Data Name="ProcessName">MoUsoCoreWorke</Data>
      <Data Name="CountDeleteFile">2</Data>
    </EventData>
  </Event>

References

2 links

Source: evtx/Maps/Microsoft-Windows-Ntfs-Operational_Microsoft-Windows-Ntfs_151.map(opens in new tab) by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)