I believe it is not possible, mostly because those...
# general
a
I believe it is not possible, mostly because those events are captured from the NTFS journal