USB forensic artifacts have been used by examiners for years; however, earlier this year, it was revealed with Windows 10 that a new event log, the Microsoft-Windows-Partition%4Diagnostics.evtx (MWPD) file emerged with event ID 1006 containing detailed information of removable devices. During this discussion, attendees will be provided a detailed introduction to MWPD, learn how these artifacts differ from previous forensics artifacts, and how to effectively mine this potential wealth of forensic information