Message	Id	Version	Qualifiers	Level	Task	Opcode	Keywords	RecordId	ProviderName	ProviderId	LogName	ProcessId	ThreadId	MachineName	UserId	TimeCreated	ActivityId	RelatedActivityId	ContainerLog	MatchedQueryIds	Bookmark	LevelDisplayName	OpcodeDisplayName	TaskDisplayName	KeywordsDisplayNames	Properties
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy14	4	0		4	6	0	4611686018427387936	84	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	512	hv-cinder-77703	S-1-5-18	11/16/2021 9:47:05 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy13	4	0		4	6	0	4611686018427387936	83	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	1176	hv-cinder-77703	S-1-5-18	11/16/2021 9:46:17 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy12	4	0		4	6	0	4611686018427387936	82	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	580	hv-cinder-77703	S-1-5-18	11/16/2021 9:46:12 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	81	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:44:43 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	80	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:44:43 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	79	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:44:43 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	78	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:44:43 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy11	4	0		4	6	0	4611686018427387936	77	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	384	hv-cinder-77703	S-1-5-18	11/16/2021 9:44:42 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	76	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:44:36 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	75	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:44:36 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	74	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:44:36 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	73	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:44:36 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy10	4	0		4	6	0	4611686018427387936	72	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	512	hv-cinder-77703	S-1-5-18	11/16/2021 9:44:34 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	71	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:44:19 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	70	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:44:19 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	69	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:44:19 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	68	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:44:19 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy9	4	0		4	6	0	4611686018427387936	67	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	384	hv-cinder-77703	S-1-5-18	11/16/2021 9:44:16 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	66	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:44:10 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	65	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:44:10 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	64	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:44:10 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	63	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:44:10 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	62	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:44:09 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	61	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:44:09 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	60	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:44:09 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	59	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:44:09 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy8	4	0		4	6	0	4611686018427387936	58	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	732	hv-cinder-77703	S-1-5-18	11/16/2021 9:44:08 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy7	4	0		4	6	0	4611686018427387936	57	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	136	hv-cinder-77703	S-1-5-18	11/16/2021 9:44:04 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	56	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:43:54 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	55	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:43:53 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	54	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:43:53 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	53	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:43:53 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy6	4	0		4	6	0	4611686018427387936	52	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	136	hv-cinder-77703	S-1-5-18	11/16/2021 9:43:52 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	51	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:43:41 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	50	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:43:41 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	49	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:43:41 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	48	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:43:41 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	47	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:43:41 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	46	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:43:41 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	45	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:43:41 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	44	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:43:41 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy5	4	0		4	6	0	4611686018427387936	43	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	136	hv-cinder-77703	S-1-5-18	11/16/2021 9:43:40 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy4	4	0		4	6	0	4611686018427387936	42	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	136	hv-cinder-77703	S-1-5-18	11/16/2021 9:43:37 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	41	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:43:33 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	40	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:43:33 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	39	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:43:33 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	38	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:43:33 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy3	4	0		4	6	0	4611686018427387936	37	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	508	hv-cinder-77703	S-1-5-18	11/16/2021 9:43:31 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	36	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:43:18 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	35	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:43:18 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	34	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:43:18 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	33	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:43:18 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	32	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:43:13 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	31	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:43:13 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	30	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:43:13 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	29	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3948	872	hv-cinder-77703	S-1-5-18	11/16/2021 9:43:13 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy2	4	0		4	6	0	4611686018427387936	28	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	136	hv-cinder-77703	S-1-5-18	11/16/2021 9:43:13 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy1	4	0		4	6	0	4611686018427387936	27	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	3444	hv-cinder-77703	S-1-5-18	11/16/2021 9:43:10 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 72117985280 Highest free space in bytes: 75205070848 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	26	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	212	hv-cinder-77703	S-1-5-18	11/16/2021 9:06:58 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: C: Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	25	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	212	hv-cinder-77703	S-1-5-18	11/16/2021 9:06:53 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 2230226944 Highest free space in bytes: 2243223552 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	24	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	188	WIN-5T344G8GM1H	S-1-5-18	11/16/2021 9:05:23 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: \\?\Volume{be07386b-0000-0000-0000-100000000000} Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	23	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	188	WIN-5T344G8GM1H	S-1-5-18	11/16/2021 9:05:17 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 29832175616 Highest free space in bytes: 29835325440 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	22	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	1988	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: C: Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	21	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	196	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:28 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 29901320192 Highest free space in bytes: 29926395904 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	20	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	2020	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:18 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: C: Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	19	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	184	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:12 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 29918121984 Highest free space in bytes: 29918121984 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	18	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	168	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:37 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: C: Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	17	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	192	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:31 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 28502818816 Highest free space in bytes: 29979299840 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	16	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	124	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:03 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: C: Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	15	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	184	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:22:58 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 28196282368 Highest free space in bytes: 28346654720 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	14	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	312	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:52 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: C: Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	13	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	184	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:47 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 28216385536 Highest free space in bytes: 28366708736 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	12	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	124	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:04 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: C: Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	11	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	184	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:49:59 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 27284545536 Highest free space in bytes: 27288723456 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	10	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	192	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:23:59 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: C: Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	9	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	192	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 10:23:53 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 24009318400 Highest free space in bytes: 24158986240 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	8	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	376	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:26 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: C: Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	7	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	184	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:21 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 26337353728 Highest free space in bytes: 26549157888 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	6	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	120	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:42:12 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: C: Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	5	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	192	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:42:06 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 32134189056 Highest free space in bytes: 32134750208 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	4	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	200	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 9:01:54 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: C: Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	3	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	176	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 9:01:49 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 32485502976 Highest free space in bytes: 33967284224 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	2	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	336	WIN-PD8DQPRRTAO	S-1-5-18	1/17/2018 3:00:55 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: \\?\Volume{be07386b-0000-0000-0000-100000000000} Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	1	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	200	WIN-PD8DQPRRTAO	S-1-5-18	1/17/2018 3:00:49 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]