> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/file-system.md).

# File System

- [1006](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/file-system/1006.md)
- [4688 - Process Created](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/file-system/4688-process-created.md): https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4688
- [4663](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/file-system/4663.md)
- [4656](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/file-system/4656.md)
- [6416](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/file-system/6416.md)
- [20001](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/file-system/20001.md)
- [20003](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/file-system/20003.md)