Record number eventType id ProcessId ThreadId dateWritten timeWritten computer user source String value Data value