The following is an example of a query to show when the Removable Storage Service wrote to the event log:select * from events where source like 'Remov%';orTo show the when the computer was started and stopped.select * from events where event_id in (6009, 6006) order by time_generated_unix desc;If you were to add the application events then you can see everything that happened during a specific tim