DataOverwrite | 1 | Data in the file was overwritten. |
DataExtend | 2 | Data was added to the file. |
DataTruncation | 4 | The file was truncated. |
NamedDataOverwrite | 16 | Data in a named data stream was overwritten. |
NamedDataExtend | 32 | A named data stream was extended. |
NamedDataTruncation | 64 | A named data stream was truncated. |
FileCreate | 256 | The file or directory was created. |
FileDelete | 512 | The file or directory was deleted. |
ExtendedAttributesChange | 1024 | The file or directory's extended attributes changed. |
SecurityChange | 2048 | The file or directory's security descriptor changed. |
RenameOldName | 4096 | The file or directory was renamed, and this is the old name. |
RenameNewName | 8192 | The file or directory was renamed, and this is the new name. |
IndexableChange | 16384 | The file or directory's indexing state changed. |
BasicInfoChange | 32768 | A file or directory's basic information changed (e.g., timestamps or attributes). |
HardLinkChange | 65536 | A hard link was added or removed. |
CompressionChange | 131072 | The file or directory's compression state changed. |
EncryptionChange | 262144 | The file or directory's encryption state changed. |
ObjectIDChange | 524288 | The object identifier changed. |
ReparsePointChange | 1048576 | The reparse point contained in the file or directory changed. |
StreamChange | 2097152 | A named stream was added to or removed from the file. |
TransactedChange | 4194304 | The file or directory changed as a result of a transacted operation. |
IntegrityChange | 8388608 | The file or directory's integrity status changed. |
Close | 2147483648 | The file or directory was closed. |
All | 2164260727 | All change reasons combined. |