Kevin Stokes has a nice write-up on a newer Windows 8.1 event log that stores ntfs usage information called the “Microsoft-Windows-Ntfs/NTFS Operational” log. It was enabled in an April 2014 windows update. It logs useful information about the volume each time you plug a device in to your computer or boot creating a nice new audit trail to reference! You can read more about it on his blog http://metasifter.blogspot.com/.