Wireshark · Display Filter Reference: EFS (pidl)

Field name	Description	Type	Versions
efs.EFS_CERTIFICATE_BLOB.cbData	CbData	Unsigned integer (32 bits)	1.0.0 to 4.4.2
efs.EFS_CERTIFICATE_BLOB.dwCertEncodingType	DwCertEncodingType	Unsigned integer (32 bits)	1.0.0 to 4.4.2
efs.EFS_CERTIFICATE_BLOB.pbData	PbData	Unsigned integer (8 bits)	1.0.0 to 4.4.2
efs.EFS_HASH_BLOB.cbData	CbData	Unsigned integer (32 bits)	1.0.0 to 4.4.2
efs.EFS_HASH_BLOB.pbData	PbData	Unsigned integer (8 bits)	1.0.0 to 4.4.2
efs.EfsRpcAddUsersToFile.FileName	FileName	Character string	1.0.0 to 4.4.2
efs.EfsRpcCloseRaw.pvContext	PvContext	Byte sequence	1.0.0 to 4.4.2
efs.EfsRpcDecryptFileSrv.FileName	FileName	Character string	1.0.0 to 4.4.2
efs.EfsRpcDecryptFileSrv.Reserved	Reserved	Unsigned integer (32 bits)	1.0.0 to 4.4.2
efs.EfsRpcEncryptFileSrv.Filename	Filename	Character string	1.0.0 to 4.4.2
efs.EfsRpcOpenFileRaw.FileName	FileName	Character string	1.0.0 to 4.4.2
efs.EfsRpcOpenFileRaw.Flags	Flags	Unsigned integer (32 bits)	1.0.0 to 4.4.2
efs.EfsRpcOpenFileRaw.pvContext	PvContext	Byte sequence	1.0.0 to 4.4.2
efs.EfsRpcQueryRecoveryAgents.FileName	FileName	Character string	1.0.0 to 4.4.2
efs.EfsRpcQueryRecoveryAgents.pRecoveryAgents	PRecoveryAgents	Label	1.0.0 to 4.4.2
efs.EfsRpcQueryUsersOnFile.FileName	FileName	Character string	1.0.0 to 4.4.2
efs.EfsRpcQueryUsersOnFile.pUsers	PUsers	Label	1.0.0 to 4.4.2
efs.EfsRpcReadFileRaw.pvContext	PvContext	Byte sequence	1.0.0 to 4.4.2
efs.EfsRpcRemoveUsersFromFile.FileName	FileName	Character string	1.0.0 to 4.4.2
efs.EfsRpcSetFileEncryptionKey.pEncryptionCertificate	PEncryptionCertificate	Label	1.0.0 to 4.4.2
efs.EfsRpcWriteFileRaw.pvContext	PvContext	Byte sequence	1.0.0 to 4.4.2
efs.ENCRYPTION_CERTIFICATE.pCertBlob	PCertBlob	Label	1.0.0 to 4.4.2
efs.ENCRYPTION_CERTIFICATE.pUserSid	PUserSid	Label	1.0.0 to 4.4.2
efs.ENCRYPTION_CERTIFICATE.TotalLength	TotalLength	Unsigned integer (32 bits)	1.0.0 to 4.4.2
efs.ENCRYPTION_CERTIFICATE_HASH.cbTotalLength	CbTotalLength	Unsigned integer (32 bits)	1.0.0 to 4.4.2
efs.ENCRYPTION_CERTIFICATE_HASH.lpDisplayInformation	LpDisplayInformation	Character string	1.0.0 to 4.4.2
efs.ENCRYPTION_CERTIFICATE_HASH.pHash	PHash	Label	1.0.0 to 4.4.2
efs.ENCRYPTION_CERTIFICATE_HASH.pUserSid	PUserSid	Label	1.0.0 to 4.4.2
efs.ENCRYPTION_CERTIFICATE_HASH_LIST.nCert_Hash	NCert Hash	Unsigned integer (32 bits)	1.0.0 to 4.4.2
efs.ENCRYPTION_CERTIFICATE_HASH_LIST.pUsers	PUsers	Label	1.0.0 to 4.4.2
efs.opnum	Operation	Unsigned integer (16 bits)	1.0.0 to 4.4.2
efs.werror	Windows Error	Unsigned integer (32 bits)	1.0.0 to 4.4.2