Macrium Image Guardian Events
To view Image Guardian windows events, take the Other Tasks menu, then select Macrium Image Guardian Settings... menu option and select the Events tab:
Number | Event Name | Severity | Description |
---|---|---|---|
100 | EVT_MIG_SERVICE_STARTED | Informational | Image Guardian service started |
110 | EVT_MIG_DRIVER_STARTED_BY_SERVICE | Informational | Image Guardian driver started by service |
200 | EVT_MIG_SERVICE_STOPPED | Informational | Image Guardian service stopped |
300 | EVT_MIG_VOLUME_PROTECTED | Informational | Volume (\\?\Volume{6a2d53fe-c79a-11e1-b189-806e6f6e6963}\) is protected |
310 | EVT_MIG_BLOCK_VERIFICATION_FILE_ACCESS | Informational | Blocking process (processname.exe) creating verification file as the process is not Macrium certified |
320 | EVT_MIG_BLOCKED_FILE_ACCESS | Warning | Blocked unauthorised process (processname.exe) accessing file (\\?\Volume{6a2d53fe-c79a-11e1-b189-806e6f6e6963}\Folder\filename.mrimg) |
330 | EVT_MIG_USER_PROTECTED_VOLUME | Informational | User has enabled Image Guardian on volume (\\?\Volume{6a2d53fe-c79a-11e1-b189-806e6f6e6963}\) |
340 | EVT_MIG_USER_DISABLED_VOLUME | Informational | User has disabled Image Guardian on volume (\\?\Volume{6a2d53fe-c79a-11e1-b189-806e6f6e6963}\) |
500 | EVT_MIG_ERROR_BAD_EVENT | Error | Error could not open Image Guardian verification event. Error code = 123 |
510 | EVT_MIG_ERROR_PROTECTING_VOLUME | Error | Error protecting volume (\\?\Volume{6a2d53fe-c79a-11e1-b189-806e6f6e6963}\). Error code = 123 |
520 | EVT_MIG_ERROR_UNPROTECTING_VOLUME | Error | Error unprotecting volume (\\?\Volume{6a2d53fe-c79a-11e1-b189-806e6f6e6963}\). Error code = 123 |
When an unauthorized process attempts to write to, delete, or rename a Macrium backup file the action will be blocked and Windows Event 320 will be generated