Message	Id	Version	Qualifiers	Level	Task	Opcode	Keywords	RecordId	ProviderName	ProviderId	LogName	ProcessId	ThreadId	MachineName	UserId	TimeCreated	ActivityId	RelatedActivityId	ContainerLog	MatchedQueryIds	Bookmark	LevelDisplayName	OpcodeDisplayName	TaskDisplayName	KeywordsDisplayNames	Properties
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	206	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	3660	hv-cinder-81713	S-1-5-18	3/18/2022 2:56:52 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	205	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	3660	hv-cinder-81713	S-1-5-18	3/18/2022 2:56:52 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	204	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	3660	hv-cinder-81713	S-1-5-18	3/18/2022 2:56:52 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	203	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	3660	hv-cinder-81713	S-1-5-18	3/18/2022 2:56:52 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy36	4	0		4	6	0	4611686018427387936	202	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	2984	hv-cinder-81713	S-1-5-18	3/18/2022 2:54:56 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	201	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:53:55 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	200	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:53:55 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	199	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:53:55 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	198	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:53:55 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy35	4	0		4	6	0	4611686018427387936	197	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	2224	hv-cinder-81713	S-1-5-18	3/18/2022 2:53:54 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	196	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:53:48 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	195	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:53:48 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	194	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:53:48 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	193	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:53:48 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy34	4	0		4	6	0	4611686018427387936	192	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	5016	hv-cinder-81713	S-1-5-18	3/18/2022 2:53:47 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	191	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:53:21 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	190	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:53:21 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	189	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:53:21 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	188	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:53:21 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	187	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:53:15 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	186	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:53:15 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	185	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:53:15 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	184	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:53:15 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy33	4	0		4	6	0	4611686018427387936	183	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	1056	hv-cinder-81713	S-1-5-18	3/18/2022 2:53:14 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy32	4	0		4	6	0	4611686018427387936	182	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	5016	hv-cinder-81713	S-1-5-18	3/18/2022 2:53:04 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	181	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:52:35 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	180	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:52:35 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	179	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:52:35 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	178	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:52:35 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	177	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:52:33 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	176	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:52:33 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	175	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:52:33 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	174	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:52:33 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy31	4	0		4	6	0	4611686018427387936	173	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	4580	hv-cinder-81713	S-1-5-18	3/18/2022 2:52:33 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	172	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:52:29 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	171	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:52:29 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	170	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:52:29 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	169	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:52:29 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy30	4	0		4	6	0	4611686018427387936	168	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	2224	hv-cinder-81713	S-1-5-18	3/18/2022 2:52:28 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	167	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:52:24 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	166	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:52:24 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	165	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:52:24 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	164	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:52:24 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy29	4	0		4	6	0	4611686018427387936	163	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	5016	hv-cinder-81713	S-1-5-18	3/18/2022 2:52:23 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	162	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:52:19 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	161	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:52:19 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	160	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:52:19 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	159	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:52:19 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy28	4	0		4	6	0	4611686018427387936	158	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	1072	hv-cinder-81713	S-1-5-18	3/18/2022 2:52:18 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy27	4	0		4	6	0	4611686018427387936	157	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	2984	hv-cinder-81713	S-1-5-18	3/18/2022 2:52:13 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	156	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:52:00 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	155	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:52:00 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	154	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:52:00 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	153	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:52:00 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy26	4	0		4	6	0	4611686018427387936	152	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	4580	hv-cinder-81713	S-1-5-18	3/18/2022 2:52:00 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	151	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:51 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	150	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:51 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	149	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:51 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	148	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:51 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy25	4	0		4	6	0	4611686018427387936	147	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	2224	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:49 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	146	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:44 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	145	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:44 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	144	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:44 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	143	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:44 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	142	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:43 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	141	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:43 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	140	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:43 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	139	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:43 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	138	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:43 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	137	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:43 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	136	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:43 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	135	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:43 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	134	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:43 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	133	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:43 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	132	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:43 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	131	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:43 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	130	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:43 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	129	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:43 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	128	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:43 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	127	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:43 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy24	4	0		4	6	0	4611686018427387936	126	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	1072	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:43 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy23	4	0		4	6	0	4611686018427387936	125	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	1056	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:40 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy22	4	0		4	6	0	4611686018427387936	124	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	2996	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:37 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy21	4	0		4	6	0	4611686018427387936	123	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	2996	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:34 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy20	4	0		4	6	0	4611686018427387936	122	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	1072	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:31 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	121	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:20 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	120	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:20 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	119	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:20 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	118	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:20 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	117	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:18 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	116	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:18 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	115	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:18 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	114	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:18 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy19	4	0		4	6	0	4611686018427387936	113	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	840	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:15 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy18	4	0		4	6	0	4611686018427387936	112	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	2984	hv-cinder-81713	S-1-5-18	3/18/2022 2:49:07 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	111	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:48:57 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	110	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:48:57 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	109	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:48:57 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	108	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:48:57 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	107	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:48:56 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	106	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:48:56 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	105	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:48:56 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	104	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:48:56 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	103	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:48:55 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	102	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:48:55 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	101	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:48:55 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	100	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:48:55 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy17	4	0		4	6	0	4611686018427387936	99	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	1380	hv-cinder-81713	S-1-5-18	3/18/2022 2:48:54 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy16	4	0		4	6	0	4611686018427387936	98	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	2996	hv-cinder-81713	S-1-5-18	3/18/2022 2:48:50 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy15	4	0		4	6	0	4611686018427387936	97	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	1268	hv-cinder-81713	S-1-5-18	3/18/2022 2:48:26 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	96	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:48:22 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	95	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:48:22 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	94	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:48:22 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	93	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:48:22 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy14	4	0		4	6	0	4611686018427387936	92	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	1380	hv-cinder-81713	S-1-5-18	3/18/2022 2:48:22 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	91	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:47:59 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	90	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:47:59 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	89	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:47:59 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	88	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:47:59 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	87	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:47:58 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	86	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:47:58 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	85	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:47:58 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	84	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:47:58 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	83	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:47:56 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	82	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:47:56 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	81	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:47:56 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	80	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:47:56 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy13	4	0		4	6	0	4611686018427387936	79	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	2224	hv-cinder-81713	S-1-5-18	3/18/2022 2:47:56 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy12	4	0		4	6	0	4611686018427387936	78	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	2224	hv-cinder-81713	S-1-5-18	3/18/2022 2:47:51 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy11	4	0		4	6	0	4611686018427387936	77	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	5088	hv-cinder-81713	S-1-5-18	3/18/2022 2:47:47 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	76	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:47:03 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	75	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:47:03 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	74	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:47:03 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	73	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:47:03 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy10	4	0		4	6	0	4611686018427387936	72	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	1380	hv-cinder-81713	S-1-5-18	3/18/2022 2:47:02 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	71	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:46:47 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	70	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:46:47 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	69	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:46:47 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	68	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:46:47 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy9	4	0		4	6	0	4611686018427387936	67	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	5088	hv-cinder-81713	S-1-5-18	3/18/2022 2:46:47 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	66	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:46:43 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	65	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:46:43 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	64	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:46:43 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	63	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:46:43 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy8	4	0		4	6	0	4611686018427387936	62	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	880	hv-cinder-81713	S-1-5-18	3/18/2022 2:46:41 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	61	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:46:13 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	60	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:46:13 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	59	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:46:13 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	58	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:46:13 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy7	4	0		4	6	0	4611686018427387936	57	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	1072	hv-cinder-81713	S-1-5-18	3/18/2022 2:46:12 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	56	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:46:05 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	55	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:46:05 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	54	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:46:05 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	53	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:46:05 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	52	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:46:04 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	51	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:46:04 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	50	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:46:04 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	49	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:46:04 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	48	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:46:04 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	47	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:46:04 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	46	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:46:04 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	45	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:46:04 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy6	4	0		4	6	0	4611686018427387936	44	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	5088	hv-cinder-81713	S-1-5-18	3/18/2022 2:46:04 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy5	4	0		4	6	0	4611686018427387936	43	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	2984	hv-cinder-81713	S-1-5-18	3/18/2022 2:46:00 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy4	4	0		4	6	0	4611686018427387936	42	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	1072	hv-cinder-81713	S-1-5-18	3/18/2022 2:45:57 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	41	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:45:53 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	40	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:45:53 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	39	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:45:53 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	38	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:45:53 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy3	4	0		4	6	0	4611686018427387936	37	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	2984	hv-cinder-81713	S-1-5-18	3/18/2022 2:45:52 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	36	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:45:45 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	35	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:45:45 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	34	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:45:45 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	33	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:45:45 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy2	4	0		4	6	0	4611686018427387936	32	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	2984	hv-cinder-81713	S-1-5-18	3/18/2022 2:45:42 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has successfully dismounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS	303	0		4	8	2	4611686018427387936	31	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:45:38 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume dismount event notification on the NTFS volume has completed.	302	0		4	8	7	4611686018427387936	30	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:45:38 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Resume		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS has sent volume dismount event notification and is waiting for the notifications to complete.	301	0		4	8	8	4611686018427387936	29	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:45:38 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Suspend		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS volume dismount has started. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: Volume Label: OS	300	0		4	8	1	4611686018427387936	28	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	3964	1108	hv-cinder-81713	S-1-5-18	3/18/2022 2:45:38 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {00000000-0000-0000-0000-000000000000} Volume Name: OS Volume Label: OS Device Name: \Device\HarddiskVolumeShadowCopy1	4	0		4	6	0	4611686018427387936	27	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	1380	hv-cinder-81713	S-1-5-18	3/18/2022 2:45:33 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 71942619136 Highest free space in bytes: 75029716992 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	26	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	188	hv-cinder-81713	S-1-5-18	3/18/2022 1:35:50 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: C: Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	25	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	228	hv-cinder-81713	S-1-5-18	3/18/2022 1:35:45 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 2230226944 Highest free space in bytes: 2243223552 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	24	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	472	WIN-5T344G8GM1H	S-1-5-18	3/18/2022 1:34:11 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: \\?\Volume{be07386b-0000-0000-0000-100000000000} Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	23	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	212	WIN-5T344G8GM1H	S-1-5-18	3/18/2022 1:34:05 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 29832175616 Highest free space in bytes: 29835325440 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	22	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	1988	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: C: Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	21	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	196	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:28 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 29901320192 Highest free space in bytes: 29926395904 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	20	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	2020	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:18 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: C: Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	19	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	184	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:12 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 29918121984 Highest free space in bytes: 29918121984 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	18	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	168	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:37 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: C: Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	17	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	192	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:31 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 28502818816 Highest free space in bytes: 29979299840 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	16	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	124	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:03 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: C: Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	15	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	184	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:22:58 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 28196282368 Highest free space in bytes: 28346654720 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	14	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	312	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:52 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: C: Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	13	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	184	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:47 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 28216385536 Highest free space in bytes: 28366708736 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	12	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	124	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:04 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: C: Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	11	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	184	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:49:59 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 27284545536 Highest free space in bytes: 27288723456 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	10	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	192	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:23:59 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: C: Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	9	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	192	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 10:23:53 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 24009318400 Highest free space in bytes: 24158986240 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	8	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	376	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:26 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: C: Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	7	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	184	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:21 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 26337353728 Highest free space in bytes: 26549157888 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	6	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	120	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:42:12 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: C: Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	5	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	192	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:42:06 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 32134189056 Highest free space in bytes: 32134750208 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	4	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	200	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 9:01:54 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: C: Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	3	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	176	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 9:01:49 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 32485502976 Highest free space in bytes: 33967284224 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	2	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	336	WIN-PD8DQPRRTAO	S-1-5-18	1/17/2018 3:00:55 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: \\?\Volume{be07386b-0000-0000-0000-100000000000} Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	1	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	200	WIN-PD8DQPRRTAO	S-1-5-18	1/17/2018 3:00:49 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]