I came across this post during my searches for Roxio/WinZip SecureBurn event codes. From my research I have found that this is what each event code means, based off the additional text contained in the Windows Event log: 1001: Blank disk inserted 1003: Writing event started (can correlate with Windows System logs, EVID 133, look for 'cdrom' in the log) 1004: Disk burned, finalized. Key terms from data fields to look for are "Finalized,Closed session" I have not been able to consistently replicate event 1001 at the beginning and end of the event, but I can consistently replicate event 1003 and 1004, so I've decided to focus on those. Hope that helps someone!   ... View more