USB Device Forensics: Insertion and removal timestamps of USB devices in Windows 8
Automated Windows event log forensics