I try to sort out if an USB memory was mounted on my computer, this is saved logs since 2016.
So could this three event be USB memory activity? (the last log is a photo of the event)



Eventxmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Kernel-General"Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />

<EventID>16</EventID>

<Version>0</Version>

<Level>4</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x8000000000000000</Keywords>

<TimeCreated SystemTime="2016-10-27T05:03:05.198973100Z" />

<EventRecordID>3913</EventRecordID>

<Correlation />

<Execution ProcessID="4" ThreadID="7560" />

<Channel>System</Channel>

<Computer>AndersH2015</Computer>

<Security UserID="S-1-5-18" />

</System>


- <EventData>
<Data Name="HiveNameLength">46</Data>

<DataName="HiveName">\Device\HarddiskVolume2\EFI\Microsoft\Boot\BCD</Data>

<Data Name="KeysUpdated">103</Data>

<Data Name="DirtyPages">11</Data>

</EventData>


</Event>


Eventxmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Kernel-General"Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />

<EventID>15</EventID>

<Version>0</Version>

<Level>4</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x8000000000000000</Keywords>

<TimeCreated SystemTime="2016-10-27T10:44:03.532324000Z" />

<EventRecordID>3929</EventRecordID>

<Correlation />

<Execution ProcessID="4308" ThreadID="10120" />

<Channel>System</Channel>

<Computer>AndersH2015</Computer>

<Security UserID="S-1-5-21-4201251730-2606191966-776299460-1005" />

</System>


- <EventData>
<Data Name="HiveNameLength">41</Data>

<Data Name="HiveName">\??\C:\Windows\System32\config\components</Data>

<Data Name="OriginalSize">71229440</Data>

<Data Name="NewSize">51052544</Data>

</EventData>


</Event>






Click image for larger version. 

Name:	IMG_4039.JPG 
Views:	2 
Size:	1.09 MB 
ID:	190886