#ifndef _NTPFAPI_H
// begin_private

typedef struct _PF_LOG_EVENT_DATA 
{
    ULONG Version; // PF_LOG_EVENT_DATA_VERSION
    union 
    {
        ULONG Packed; // [31:7]=DataSize, [6:5]=Flags, [4:0]=EventType (PF_EVENT_TYPE)
        struct 
        {
            ULONG DataSize : 25; // in bytes
            ULONG Flags    : 2;
            ULONG EventType: 5; // 2,3,5,27 accepted by the handler // PF_EVENT_TYPE
        };
    };
    PVOID EventData;
    HANDLE PartitionHandle;
} PF_LOG_EVENT_DATA , *PPF_LOG_EVENT_DATA ;

// end_private
#endif
View code on GitHub