Parity item, bundled speculatively. The Microsoft-Windows-Ntfs/Operational log records volume health/corruption, not reliable USB connect/disconnect events, so its USB forensic value is marginal.
Decision needed: confirm a concrete USB-relevant EID→claim mapping with an authoritative source before building, else keep deferred. Do not build to check a box.
Parity item, bundled speculatively. The Microsoft-Windows-Ntfs/Operational log records volume health/corruption, not reliable USB connect/disconnect events, so its USB forensic value is marginal.
Decision needed: confirm a concrete USB-relevant EID→claim mapping with an authoritative source before building, else keep deferred. Do not build to check a box.