Improving Windows External Device Investigations [updated] slides posted from #CEICCONF #DFIR