Each item is identified by a Serial64 or ID64 (Unique Identifier for the Item), you can find Serial64 in _LogEventItem then look at where it went via logs.
For example:
Code:
SELECT * FROM _LogEventItem WHERE Serial64 = X
About the HWID, Mac, IP stuff. Filters usually execute a certain procedure with these information that's how they're logged into the table. Check the procedures