Elastic Windows Event Explorer

Publisher - Microsoft-Windows-ReFS-v1

Event ID 515


The file system detected a corruption on a folder. Contents of the folder have been removed from the file system namespace. The name of the folder is "%{ObjectName}".

Event Data:

# Name In Type
Out Type
1 ObjectNameLength win:UInt16 xs:unsignedShort
2 ObjectName win:UnicodeString xs:string
3 FailureReason win:HexInt32 win:NTStatus

Observed Windows Versions:

Version: 0

Fingerprint: VCFYUY2SR6JOG