#ifndef _NTPFAPI_H

/**
 * The PF_LOG_EVENT_DATA structure supplies an event payload for SuperfetchLogEvent.
 */
typedef struct _PF_LOG_EVENT_DATA
{
    ULONG Version;                              // PF_LOG_EVENT_DATA_VERSION
    union
    {
        ULONG Packed;                           // [31:7]=DataSize, [6:5]=Flags, [4:0]=EventType (PF_EVENT_TYPE)
        struct
        {
            ULONG EventType : 5;                // PF_EVENT_TYPE: 2, 3, 5 or 27.
            ULONG Flags : 2;                    // Two event-logging flag bits, packed at bits 5..6.
            ULONG DataSize : 25;                // Bytes; < 0xff0. Minimum: 36 for 2/3, 12 for 5, 16 for 27.
        };
    };
    HANDLE PartitionHandle;                     // Input partition handle at offset 8 on x64.
    PVOID EventData;                            // Pointer to the input event payload at offset 16 on x64.
} PF_LOG_EVENT_DATA, *PPF_LOG_EVENT_DATA;

#endif
View code on GitHub