FYI all - if you don't see all of the DELETE events that you believe should exist in the win_file_events table, be sure that it really is a deletion and not a file being moved to the recycle bin. For more information, see the snippet in this thread.