External Device is used to track Removable Media activity. Removable Media one of the most prevalent attack vectors for malware and a common ex-filtration tactic for insider threats. Fortunately for us, Windows keeps track of a coniderable amount of data-points regarding USB devices. We can identify the First/Last time a USB was inserted into a host, what drive letter was assigned, and properties about the specific USB device itself such as the vendor, product, and serial number.